View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0000948Main CAcert Websitesource codepublic2011-06-04 22:112013-01-15 17:22
Reporterdakon Assigned ToUli60  
PrioritynormalSeverityminorReproducibilityhave not tried
Status closedResolutionfixed 
Fixed in Version2011 Q3 
Summary0000948: Email address verification violates SMTP protocol
DescriptionIf I want to verify a new email address a connection to my server is is created. The transaction looks as follows:

Jun 5 00:07:09 mail Qsmtpd[7431]: > 220 mail.sf-mail.de Qsmtpd 0.19svn ESMTP
Jun 5 00:07:09 mail Qsmtpd[7431]: < HELO www.cacert.org
Jun 5 00:07:09 mail Qsmtpd[7431]: > 250 mail.sf-mail.de
Jun 5 00:07:09 mail Qsmtpd[7431]: < MAIL FROM: <returns@cacert.org>
Jun 5 00:07:09 mail Qsmtpd[7431]: > 250 2.1.5 sender <returns@cacert.org> is syntactically correct
Jun 5 00:07:09 mail Qsmtpd[7431]: < RCPT TO: <foobar@example.com>
Jun 5 00:07:09 mail Qsmtpd[7431]: > 500 5.5.2 command syntax error
Jun 5 00:07:09 mail Qsmtpd[7431]: < QUIT
Jun 5 00:07:09 mail Qsmtpd[7431]: > 221 2.0.0 mail.sf-mail.de service closing transmission channel

The mails are rejected because of the space between ':' and '<' in both the MAIL FROM and RCPT TO commands.
Additional InformationSee RfC 2821 and RfC 5321, section 4.1.1.2:
mail = "MAIL FROM:" Reverse-path [SP Mail-parameters] CRLF

As you might have noticed there is an explicit mentioning of SP before extra parameters. This means there has to be a single whitespace if you want to add a parameter behind the closing bracket and the start of the parameter. Other spaces may not appear on the line.
TagsNo tags attached.
Attached Files
mysql.php.sample (3,652 bytes)
general.php (30,439 bytes)
Reviewed bydastrath, NEOatNHNG
Test Instructions

Activities

Uli60

2011-06-05 12:51

updater   ~0002011

Last edited: 2011-06-05 13:09

 /includes/mysql.php.sample
is the proposed RFC-2821 compliant fix, to remove the extra
white space before mail-from and before rcpt-to addresses
from the code base
extra infos:
- http://www.snertsoft.com/smtp/smtpf/summary.html#opt_rfc2821_extra_spaces
- http://bugs.php.net/28038

as production mysql.php is not distributed
with the repository, this fix needs to be added manualy
by the Software-Assessors or the Critical Team

One question that araises:
can the function sendmail() outsourced to another
include file ?
eg mysql.php
    ..
    include_once("/includes/mysql-functions.php");
    ..
???

Uli60

2011-06-06 02:47

updater   ~0002012

Last edited: 2011-06-06 02:47

 domain check is affected too
/includes/general.php

Ted

2011-06-07 22:16

administrator   ~0002013

Added the proposed changes to git branch bug-948

Uli60

2011-06-08 01:58

updater   ~0002021

patch added, review #1 by Ted
test is difficult for testers, as a raw smtp log is not available to check.
emails are redirected on testserver to TMS mailbox
but w/o further header debug infos

needs 2nd review

Uli60

2011-06-28 23:59

updater   ~0002069

dirk, NEO, added to cacert-devel, added to testserver

Uli60

2011-06-29 00:05

updater   ~0002070

Last edited: 2011-06-29 00:24

 new account join -> TMS rcvd mail probe: ok
2nd account: assure someone -> new account ->
rcvd mail by new account:
 You were issued 35 points and you now have 35 points in total. -> ok
assurer rcvd email:
 You issued 35 points and they now have 35 points in total. -> ok

new user - create client cert
rcvd email:
If you have not imported CAcert´s root certificate, please go to:
https://www.cacert.org/index.php?id=3
Root cert fingerprint = A6:1B:37:5E:39:0D:9C:36:54:EE:BD:20:31:46:1F:6B
Root cert fingerprint = 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33
-> ok

add domain - rcvd mail:
Below is the link you need to open to verify your domain 'xxx'. Once your address is verified you will be able to start issuing certificates to your heart's content! -> ok

find an assurer - contact assurer -> ok

assure someone - use non-existent email - send reminder notice
mhh, don't know where to find the email ...
account doesn't exist, cannot login to tms (this is as expected)
cannot be checked

NEOatNHNG

2011-06-29 11:59

administrator   ~0002071

Patch reviewed. No complaints, good to go. So once we have a few extra tests we can put it into production.

INOPIAE

2011-06-30 08:46

updater   ~0002074

Tested:
join new member: ok
assure sombody: assuree OK, assurer OK
client certificate: OK

Uli60

2011-07-05 21:26

updater   ~0002090

client.pl needs update too
line 640 sub sendmail()
l.673 print $smtp "MAIL FROM: <returns\@cacert.org>\r\n";
l.679 print $smtp "RCPT TO: <".trim($user).">\r\n";

NEOatNHNG

2011-07-07 00:06

administrator   ~0002100

Reminder sent to: egal

Dirk made those changes to the /CommModule/client.pl and applied them to the test server on our last Software Assessment meeting yesterday.

NEOatNHNG

2011-07-07 00:09

administrator   ~0002101

I have reviewed the changes to the /CommModule/client.pl and they are OK. So only some more testing needed before it can go to production.

Uli60

2011-07-07 01:00

updater   ~0002102

client.pl update effects _all_ mails on cert creations
org / individual members, client / server certs
as sub sendmail is a function used in main HandleCerts function

Uli60

2011-07-13 01:03

updater   ~0002123

tests finished review:
needs more testing, see instructions under
https://bugs.cacert.org/view.php?id=948#c2070

INOPIAE

2011-07-19 21:58

updater   ~0002154

join new member: mail recivied -> ok
assure sombody: assuree mail recivied -> ok, assurer mail recivied -> ok
client certificate: mail recivied -> ok
add domain: mail recivied -> ok
find assurer: mail recivied -> ok
Edit data: mail recivied -> ok

Uli60

2011-07-19 23:29

updater   ~0002163

small bugfix to get smtp routines rfc aware
no function blocked
tested by 2 users at application level
further testing needs low level testing.
this is impossible with testserver environment
so therefor ready to deploy

NEOatNHNG

2011-07-21 13:35

administrator   ~0002173

Patch request sent to critical admins

wytze

2011-07-22 14:17

developer   ~0002179

Patch applied to production system on July 22, 2011.
See https://lists.cacert.org/wws/arc/cacert-systemlog/2011-07/msg00008.html

Issue History

Date Modified Username Field Change
2011-06-04 22:11 dakon New Issue
2011-06-05 12:44 Uli60 File Added: mysql.php.sample
2011-06-05 12:51 Uli60 Note Added: 0002011
2011-06-05 13:08 Uli60 Note Edited: 0002011
2011-06-05 13:09 Uli60 Note Edited: 0002011
2011-06-06 02:47 Uli60 Note Added: 0002012
2011-06-06 02:47 Uli60 Note Edited: 0002012
2011-06-06 02:48 Uli60 File Added: general.php
2011-06-07 22:16 Ted Note Added: 0002013
2011-06-08 01:56 Uli60 Status new => needs work
2011-06-08 01:56 Uli60 Assigned To => Uli60
2011-06-08 01:58 Uli60 Note Added: 0002021
2011-06-08 01:58 Uli60 Status needs work => confirmed
2011-06-14 22:08 NEOatNHNG Assigned To Uli60 => Ted
2011-06-14 22:08 NEOatNHNG Status confirmed => needs review & testing
2011-06-14 22:08 NEOatNHNG Assigned To Ted => Uli60
2011-06-14 22:08 NEOatNHNG Status needs review & testing => needs work
2011-06-14 22:09 NEOatNHNG Status needs work => needs review & testing
2011-06-28 23:59 Uli60 Note Added: 0002069
2011-06-29 00:05 Uli60 Note Added: 0002070
2011-06-29 00:07 NEOatNHNG Source_changeset_attached => cacert-devel master 4d94bd33
2011-06-29 00:07 Source_changeset_attached => cacert-devel master 5bdc30d8
2011-06-29 00:12 Uli60 Note Edited: 0002070
2011-06-29 00:20 Uli60 Note Edited: 0002070
2011-06-29 00:24 Uli60 Note Edited: 0002070
2011-06-29 11:59 NEOatNHNG Note Added: 0002071
2011-06-29 11:59 NEOatNHNG Status needs review & testing => needs testing
2011-06-30 08:46 INOPIAE Note Added: 0002074
2011-07-05 21:26 Uli60 Note Added: 0002090
2011-07-05 22:05 Source_changeset_attached => cacert-devel master 50939092
2011-07-05 22:05 Source_changeset_attached => cacert-devel master 3d6c4ebb
2011-07-07 00:06 NEOatNHNG Note Added: 0002100
2011-07-07 00:09 NEOatNHNG Note Added: 0002101
2011-07-07 00:10 NEOatNHNG Reviewed by => dastrath, NEOatNHNG
2011-07-07 01:00 Uli60 Note Added: 0002102
2011-07-13 01:03 Uli60 Note Added: 0002123
2011-07-19 21:58 INOPIAE Note Added: 0002154
2011-07-19 23:29 Uli60 Note Added: 0002163
2011-07-19 23:29 Uli60 Status needs testing => ready to deploy
2011-07-21 13:35 NEOatNHNG Note Added: 0002173
2011-07-21 13:40 NEOatNHNG Source_changeset_attached => cacert-devel release 18e17465
2011-07-22 14:17 wytze Note Added: 0002179
2011-07-22 14:17 wytze Status ready to deploy => closed
2011-07-22 14:17 wytze Resolution open => fixed
2012-08-28 10:02 Uli60 Relationship added related to 0001054
2012-08-28 12:11 NEOatNHNG Relationship deleted related to 0001054
2013-01-15 17:22 Werner Dworak Fixed in Version => 2011 Q3