BUG: service(auth) crash when quota-status lookup an address with local-part starting with auth_master_user_separator

Marco Giunta giunta at sissa.it
Tue Sep 29 08:36:22 UTC 2015


Hi,
I'm using dovecot 2.2.15 (configuration attached below), and I 've 
enabled quota-status; when I try to look up the quota status of an 
address with the local-part starting with the same character as 
'auth_master_user_separator', dovecot/auth crash:

My 'auth_master_user_separator' is '*'

# telnet localhost 25001
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
request=smtpd_access_policy
sender=johndoe at example.com
recipient=*@example.com
size=100000000

action=DEFER_IF_PERMIT Internal error occurred. Refer to server log for 
more information.

request=smtpd_access_policy
sender=johndoe at example.com
recipient=*janedoe at example.com
size=100000000

action=DEFER_IF_PERMIT Internal error occurred. Refer to server log for 
more information.

request=smtpd_access_policy
sender=johndoe at example.com
recipient=;@example.com
size=100000000

action=DUNNO

request=smtpd_access_policy
sender=johndoe at example.com
recipient=;janedoe at example.com
size=100000000


and in server log:

Sep 29 08:51:05 my_server dovecot: master: Dovecot v2.2.15 starting up 
for imap, pop3, lmtp, sieve (core dumps disabled)
Sep 29 08:51:05 my_server dovecot: master: Warning: /mnt is no longer 
mounted. See http://wiki2.dovecot.org/Mountpoints
Sep 29 08:51:41 my_server dovecot: auth: Panic: file auth-request.c: 
line 1252 (auth_request_set_login_username): assertion failed: 
(*username != '\0')
Sep 29 08:51:41 my_server dovecot: auth: Error: Raw backtrace: 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a7126a] -> 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a712d6] -> 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a70cac] -> dovecot/auth 
[0x4131eb] -> dovecot/auth(auth_request_set_username+0x94) [0x413284] -> 
dovecot/auth [0x40dc4c] -> dovecot/auth [0x40e60b] -> 
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x49) [0x3d70a82699] 
-> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd5) 
[0x3d70a83a55] -> 
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) 
[0x3d70a82739] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) 
[0x3d70a829b8] -> 
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) 
[0x3d70a29233] -> dovecot/auth(main+0x383) [0x41cfc3] -> 
/lib64/libc.so.6(__libc_start_main+0xf4) [0x3302e1d9f4] -> dovecot/auth 
[0x40b5f9]
Sep 29 08:51:41 my_server dovecot: quota-status: Error: userdb 
lookup(*@example.com): Disconnected unexpectedly
Sep 29 08:51:41 my_server dovecot: auth: Fatal: master: service(auth): 
child 2147 killed with signal 6 (core dumps disabled)
Sep 29 10:02:02 my_server dovecot: auth: Fatal: master: service(auth): 
child 12592 killed with signal 6 (core dumps disabled)
Sep 29 10:03:52 my_server dovecot: auth: Panic: file auth-request.c: 
line 1252 (auth_request_set_login_username): assertion failed: 
(*username != '\0')
Sep 29 10:03:52 my_server dovecot: auth: Error: Raw backtrace: 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a7126a] -> 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a712d6] -> 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a70cac] -> dovecot/auth 
[0x4131eb] -> dovecot/auth(auth_request_set_username+0x94) [0x413284] -> 
dovecot/auth [0x40dc4c] -> dovecot/auth [0x40e60b] -> 
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x49) [0x3d70a82699] 
-> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd5) 
[0x3d70a83a55] -> 
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) 
[0x3d70a82739] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) 
[0x3d70a829b8] -> 
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) 
[0x3d70a29233] -> dovecot/auth(main+0x383) [0x41cfc3] -> 
/lib64/libc.so.6(__libc_start_main+0xf4) [0x3302e1d9f4] -> dovecot/auth 
[0x40b5f9]
Sep 29 10:03:52 my_server dovecot: quota-status: Error: userdb 
lookup(*janedoe at example.com): Disconnected unexpectedly
Sep 29 10:03:52 my_server dovecot: auth: Fatal: master: service(auth): 
child 9945 killed with signal 6 (core dumps disabled)
Sep 29 10:16:10 my_server dovecot: auth: userdb(?): Username character 
disallowed by auth_username_chars: 0x3b (username: ;@example.com)
Sep 29 10:16:43 my_server dovecot: auth: userdb(?): Username character 
disallowed by auth_username_chars: 0x3b (username: ;janedoe at example.com)


If I change my 'auth_master_user_separator' to an other character, for 
example ';' :

# telnet localhost 25001
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
request=smtpd_access_policy
sender=johndoe at example.com
recipient=*@example.com
size=100000000

action=DUNNO

request=smtpd_access_policy
sender=johndoe at example.com
recipient=*janedoe at example.com
size=100000000

action=DUNNO

request=smtpd_access_policy
sender=johndoe at example.com
recipient=;@example.com
size=100000000

action=DEFER_IF_PERMIT Internal error occurred. Refer to server log for 
more information.

request=smtpd_access_policy
sender=johndoe at example.com
recipient=;janedoe at example.com
size=100000000

action=DEFER_IF_PERMIT Internal error occurred. Refer to server log for 
more information.


and server log:

Sep 29 10:20:00 my_server dovecot: auth: userdb(?): Username character 
disallowed by auth_username_chars: 0x2a (username: *@example.com)
Sep 29 10:20:31 my_server dovecot: auth: userdb(?): Username character 
disallowed by auth_username_chars: 0x2a (username: *janedoe at example.com)
Sep 29 10:20:54 my_server dovecot: auth: Panic: file auth-request.c: 
line 1252 (auth_request_set_login_username): assertion failed: 
(*username != '\0')
Sep 29 10:20:54 my_server dovecot: auth: Error: Raw backtrace: 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a7126a] -> 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a712d6] -> 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a70cac] -> dovecot/auth 
[0x4131eb] -> dovecot/auth(auth_request_set_username+0x94) [0x413284] -> 
dovecot/auth [0x40dc4c] -> dovecot/auth [0x40e60b] -> 
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x49) [0x3d70a82699] 
-> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd5) 
[0x3d70a83a55] -> 
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) 
[0x3d70a82739] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) 
[0x3d70a829b8] -> 
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) 
[0x3d70a29233] -> dovecot/auth(main+0x383) [0x41cfc3] -> 
/lib64/libc.so.6(__libc_start_main+0xf4) [0x3302e1d9f4] -> dovecot/auth 
[0x40b5f9]
Sep 29 10:20:54 my_server dovecot: quota-status: Error: userdb 
lookup(;@example.com): Disconnected unexpectedly
Sep 29 10:20:54 my_server dovecot: auth: Fatal: master: service(auth): 
child 19941 killed with signal 6 (core dumps disabled)
Sep 29 10:21:15 my_server dovecot: auth: Panic: file auth-request.c: 
line 1252 (auth_request_set_login_username): assertion failed: 
(*username != '\0')
Sep 29 10:21:15 my_server dovecot: auth: Error: Raw backtrace: 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a7126a] -> 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a712d6] -> 
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a70cac] -> dovecot/auth 
[0x4131eb] -> dovecot/auth(auth_request_set_username+0x94) [0x413284] -> 
dovecot/auth [0x40dc4c] -> dovecot/auth [0x40e60b] -> 
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x49) [0x3d70a82699] 
-> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd5) 
[0x3d70a83a55] -> 
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) 
[0x3d70a82739] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) 
[0x3d70a829b8] -> 
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) 
[0x3d70a29233] -> dovecot/auth(main+0x383) [0x41cfc3] -> 
/lib64/libc.so.6(__libc_start_main+0xf4) [0x3302e1d9f4] -> dovecot/auth 
[0x40b5f9]
Sep 29 10:21:15 my_server dovecot: quota-status: Error: userdb 
lookup(;janedoe at example.com): Disconnected unexpectedly
Sep 29 10:21:15 my_server dovecot: auth: Fatal: master: service(auth): 
child 20758 killed with signal 6 (core dumps disabled)


of course, I don't have any address '*@example.com' or 
'*janedoe at example.com', but some bot in internet try to send emails to 
these addresses, and my Postfix ask my dovecot server for the quota of 
'*' or '*janedoe' user.

I've solved the problem adding a REJECT rule to Postfix to discard the 
mail to '*@example.com' before the quota check, but this problem should 
be solved in Dovecot.


thank you,
   Marco


My configuration:


# 2.2.15: /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.6 (3e924b1b6c5c+)
# OS: Linux 2.6.18-406.el5 x86_64 Red Hat Enterprise Linux Server 
release 5.11 (Tikanga) ext3
auth_master_user_separator = *
auth_mechanisms = plain login
auth_verbose = yes
auth_verbose_passwords = sha1
disable_plaintext_auth = no
doveadm_password = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
doveadm_port = 12345
first_valid_uid = 200
hostname = myserver.example.com
imap_client_workarounds = delay-newmail
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
lda_original_recipient_header = X-Original-To
listen = *
login_log_format_elements = user=<%u> PID=%p method=%m rip=%r lip=%l %c
login_trusted_networks = XXX.XXX.XXX.XXX
mail_gid = mail
mail_home = /var/spool/mail/%1n/%n
mail_location = 
maildir:/var/spool/mail/%1n/%n:INDEX=/var/shared/indexes/%1n/%n
mail_plugins = acl mailbox_alias quota
mail_shared_explicit_inbox = yes
mail_uid = vmail
maildir_very_dirty_syncs = yes
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope 
encoded-character vacation subaddress comparator-i;ascii-numeric 
relational regex imap4flags copy include variables body enotify 
environment mailbox date ihave duplicate vacation-seconds imapflags notify
mbox_write_locks = fcntl
mmap_disable = yes
namespace archives {
   hidden = no
   inbox = no
   list = children
   location = 
maildir:/var/spool/archives/%1n/%n:INDEX=/var/shared/indexes/%1n/%n/archives
   mailbox 2015 {
     auto = subscribe
     special_use = \Archive
   }
   prefix = Archives.
   separator = .
   subscriptions = no
   type = private
}
namespace inbox {
   inbox = yes
   location =
   mailbox Drafts {
     auto = subscribe
     special_use = \Drafts
   }
   mailbox Junk {
     auto = subscribe
     special_use = \Junk
   }
   mailbox Sent {
     auto = subscribe
     special_use = \Sent
   }
   mailbox Trash {
     auto = subscribe
     special_use = \Trash
   }
   prefix =
   separator = .
}
namespace others {
   list = children
   location = 
maildir:/var/spool/mail/%%1n/%%n:INDEXPVT=/var/shared/indexes/%1n/%n/shared/%%n
   prefix = Other Users.%%n.
   separator = .
   subscriptions = no
   type = shared
}
namespace others_archives {
   list = children
   location = 
maildir:/var/spool/archives/%%1n/%%n:INDEXPVT=/var/shared/indexes/%1n/%n/shared/%%n/archives
   prefix = Other Users Archives.%%n.
   separator = .
   subscriptions = no
   type = shared
}
passdb {
   args = /etc/dovecot/passwd.masterusers
   driver = passwd-file
   master = yes
   pass = yes
}
passdb {
   args = /etc/dovecot/dovecot-ldap.conf.ext
   driver = ldap
}
plugin {
   acl = vfile:/etc/dovecot/global-acls:cache_secs=300
   acl_shared_dict = file:/var/shared/dovecot/shared-mailboxes.dict
   fts = solr
   fts_autoindex = yes
   fts_autoindex_max_recent_msgs = 20
   fts_solr = url=http://solr.localdomain:8080/solr/
   mailbox_alias_new = INBOX_spam
   mailbox_alias_old = Junk
   quota = maildir:User quota:ns=
   quota2 = maildir:Archive quota:ns=Archives.
   quota2_rule = *:storage=20GB
   quota2_warning = storage=95%% quota2-warning 95 %u
   quota2_warning2 = storage=90%% quota2-warning 90 %u
   quota2_warning3 = storage=80%% quota2-warning 80 %u
   quota_rule = *:storage=5GB
   quota_rule2 = Trash:storage=+20%%
   quota_status_nouser = DUNNO
   quota_status_overquota = 552 5.2.2 Quota exceeded (mailbox for user 
is full)
   quota_status_success = DUNNO
   quota_warning = storage=100%% quota-warning 100 %u
   quota_warning2 = storage=95%% quota-warning 95 %u
   quota_warning3 = storage=90%% quota-warning 90 %u
   quota_warning4 = storage=80%% quota-warning 80 %u
   sieve = file:~/sieve;active=~/sieve/.dovecot.sieve
   sieve_default = /etc/dovecot/sieve/dovecot.sieve
   sieve_extensions = +notify +imapflags +vacation-seconds
   sieve_max_redirects = 16
   sieve_vacation_min_period = 0s
}
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
postmaster_address = postmaster at example.com
protocols = imap pop3 lmtp sieve
rejection_reason = Your message to <%t> was automatically rejected for 
the following reason - il tuo messaggio a <%t> è stato rifiutato per il 
seguente motivo:%n%n%r
rejection_subject = Rejected - Messaggio rifiutato: %s
service auth {
   inet_listener {
     port = 49494
   }
   unix_listener auth-userdb {
     user = vmail
   }
}
service dict {
   unix_listener dict {
     user = vmail
   }
}
service doveadm {
   inet_listener {
     port = 26001
   }
}
service imap-login {
   process_min_avail = 16
   service_count = 0
}
service imap {
   process_limit = 2048
}
service lmtp {
   inet_listener lmtp {
     port = 24
   }
   process_min_avail = 5
}
service managesieve-login {
   inet_listener sieve {
     port = 4190
   }
   inet_listener sieve_deprecated {
     port = 2000
   }
   process_min_avail = 16
   service_count = 0
   vsz_limit = 256 M
}
service quota-status {
   client_limit = 1
   executable = /usr/libexec/dovecot/quota-status -p postfix
   inet_listener {
     port = 25001
   }
}
service quota-warning {
   executable = script /usr/local/bin/dovecot-quota-warning.sh
   unix_listener quota-warning {
     user = vmail
   }
   user = vmail
}
service quota2-warning {
   executable = script /usr/local/bin/dovecot-quota2-warning.sh
   unix_listener quota2-warning {
     user = vmail
   }
   user = vmail
}
ssl_cert = </etc/pki/dovecot/certs/myserver-crt.pem
ssl_key = </etc/pki/dovecot/private/myserver-key.pem
ssl_protocols = !SSLv2 !SSLv3
submission_host = smtp.example.com:25
syslog_facility = local2
userdb {
   driver = prefetch
}
userdb {
   args = /etc/dovecot/dovecot-ldap.conf.ext
   driver = ldap
}
protocol lmtp {
   mail_plugins = acl mailbox_alias quota sieve
   postmaster_address = postmaster at example.com
}
protocol lda {
   info_log_path =
   log_path =
   mail_plugins = acl mailbox_alias quota sieve
   syslog_facility = local2
}
protocol imap {
   mail_max_userip_connections = 50
   mail_plugins = acl mailbox_alias quota imap_quota imap_acl
}
protocol sieve {
   mail_max_userip_connections = 50
}
protocol pop3 {
   mail_max_userip_connections = 50
}




-- 
  -----------------------------------
|Marco Giunta - SISSA Computer Staff|
|Via Bonomea, 265                   |
|34136 - Trieste, Italy             |
|Tel: +39-40-3787-503               |
|Fax: +39-040-3787-244              |
|e-mail: giunta at sissa.it            |
  -----------------------------------


More information about the dovecot mailing list