Managesieve segfault bug. Test case and work around included

Steven Kurylo <[email protected]> Tue, 19 Jul 2011 22:22:05 -0700
Newsgroups gmane.mail.perdition.user
Message-ID <CAMd2BmOzE7_5UvGiyccfK-W+RdA6i5tX6eBdJWT6U3ueMOkwMw@mail.gmail.com> 
Hi,

I've tried perdition_1.19~rc4-3 but I still get a segfault.  I'm
running cyrus 2.4.8, and I can avoid the segfault under two scenarios:
1) With "sasl_mech_list: LOGIN PLAIN" and "allowplaintext: no" in my
cyrus config
2) With "sasl_mech_list: PLAIN" and "allowplaintext: yes" in my cyrus config

In my environment, we have a client which can't do TLS, so a special
sieve daemon which allows plaintext listens on local host for it.
Originally #2 also offered LOGIN and I that's how I ran into the
segfault.

It seems to be something in the sieve banner parsing.  I've made a
python script to act as a sieve server (see attached):
./server.py

Then I run perdition:
perdition.managesieve  -d --no_daemon --listen_port=2006 -C
--outgoing_server=127.0.0.1:2005 -f '' --pid_file /tmp/sieve.pid

Then I telnet to 2006 and paste :
AUTHENTICATE "PLAIN" "<real auth string>"

I either get an OK or a segfault in perdition.  server.py will cycle
through the specified banners, so you can continue to telnet to try
each banner test case out.

Let me know if you need any further information.  Thanks.

-- 
Steven Kurylo

______________________________________________
Perdition-users mailing list
[email protected]
http://lists.vergenet.net/listinfo/perdition-users
server.py (text/x-python, 1.5 KB) 
#!/usr/bin/env python
import socket,sys

banners = [] # (Crash?,banner)
#bad
# PLAIN LOGIN and no TLS
banners.append((True,'"IMPLEMENTATION" "Cyrus timsieved"\r\n"SASL" "PLAIN LOGIN"\r\n"SIEVE" "comparator-i;ascii-numeric fileinto reject vacation imapflags notify envelope relational regex subaddress copy"\r\nOK\r\n'))
#good
# PLAIN and no TLS
banners.append((False,'"IMPLEMENTATION" "Cyrus timsieved"\r\n"SASL" "PLAIN"\r\n"SIEVE" "comparator-i;ascii-numeric fileinto reject vacation imapflags notify envelope relational regex subaddress copy"\r\nOK\r\n'))
#good
# PLAIN LOGIN and TLS
banners.append((False,'"IMPLEMENTATION" "Cyrus timsieved"\r\n"SASL" "LOGIN PLAIN"\r\n"SIEVE" "comparator-i;ascii-numeric fileinto reject vacation imapflags notify envelope relational regex subaddress copy"\r\n"STARTTLS"\r\nOK\r\n'))


try:
	num = int(sys.argv[1])
except:
	num = 0

s = socket.socket()
s.bind(('127.0.0.1', 2005))
while 1:
	s.listen(1)
	try:
		banner = banners[num]
	except:
		num = 0
		banner = banners[num]
	try:
		conn, addr = s.accept()
		print 'Connected by', addr
		conn.send(banner[1])
		data = conn.recv(1024)
		if data:
			conn.send('OK "It worked"\r\n')
			crash = False
		else:
			crash = True
		conn.close()
		if crash is banner[0]:
			print 'Banner %i, expected results is %s perdition crash: %s' % (num,banner[0],crash)
		else:
			print 'Banner %i, unexpected results is %s perdition crash: %s' % (num,banner[0],crash)

	except KeyboardInterrupt: 
		break
	num = num + 1