Closed martinjanda closed 2 months ago
mjl-
commented
2 months ago @martinjanda Could you try replacing 234 with 334 on the line below? The 234 looks like a typo, I don't recognize it as a valid smtp response code. 334 means "continuation data", which this is. Other lines above/below are also checking for 334.
martinjanda
commented
2 months ago Thank you. It fails faster, but error in log of snappymail is the same:
[2024-05-09 12:57:29.693][f6d1dfb6] SMTP[INFO]: Start connection to "tcp://localhost:587"
[2024-05-09 12:57:29.693][f6d1dfb6] SMTP[INFO]: Connect (success)
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[DEBUG]: 0.0002899169921875 (raw connection)
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 220 mail.smartus.cz ESMTP mox v0.0.11\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: > EHLO _\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250-mail.smartus.cz\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250-PIPELINING\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250-SIZE 104857600\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250-REQUIRETLS\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250-AUTH SCRAM-SHA-256-PLUS SCRAM-SHA-256 SCRAM-SHA-1-PLUS SCRAM-SHA-1 CRAM-MD5 PLAIN LOGIN\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250-FUTURERELEASE 5184000 2024-07-08T12:57:29Z\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250-ENHANCEDSTATUSCODES\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250-8BITMIME\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250-LIMITS RCPTMAX=1000\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 250 SMTPUTF8\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: > AUTH SCRAM-SHA-256\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 334 \r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: > *******\r\n
[2024-05-09 12:57:29.694][f6d1dfb6] SMTP[INFO]: < 334 HASH==\r\n
[2024-05-09 12:57:29.700][f6d1dfb6] SMTP[INFO]: > *******\r\n
[2024-05-09 12:57:29.700][f6d1dfb6] SMTP[INFO]: < 334 HASH2==\r\n
[2024-05-09 12:57:29.700][f6d1dfb6] SMTP[ERROR]: MailSo\Smtp\Exceptions\NegativeResponseException: 334 HASH2== in /var/www/webmail/snappymail/v/2.36.1/app/libraries/MailSo/Smtp/SmtpClient.php:579
Stack trace:
#0 /var/www/webmail/snappymail/v/2.36.1/app/libraries/MailSo/Smtp/SmtpClient.php(487): MailSo\Smtp\SmtpClient->validateResponse()
#1 /var/www/webmail/snappymail/v/2.36.1/app/libraries/MailSo/Smtp/SmtpClient.php(210): MailSo\Smtp\SmtpClient->sendRequestWithCheck()
#2 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Model/Account.php(264): MailSo\Smtp\SmtpClient->Login()
#3 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Model/Account.php(230): RainLoop\Model\Account->netClientLogin()
#4 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Actions/Messages.php(792): RainLoop\Model\Account->SmtpConnectAndLogin()
#5 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Actions/Messages.php(192): RainLoop\Actions->smtpSendMessage()
#6 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/ServiceActions.php(134): RainLoop\Actions->DoSendMessage()
#7 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Service.php(132): RainLoop\ServiceActions->ServiceJson()
#8 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Service.php(14): RainLoop\Service::RunResult()
#9 /var/www/webmail/snappymail/v/2.36.1/include.php(136): RainLoop\Service::Handle()
#10 /var/www/webmail/index.php(11): include('...')
#11 {main}
[2024-05-09 12:57:29.700][f6d1dfb6] SMTP[NOTICE]: MailSo\Smtp\Exceptions\NegativeResponseException: 334 dj1UNk1aZlBLRW0xQlMvVWVHUURab0tiOEhJWTl3YUxNYmVQcHU5OTFoV3hZPQ== in /var/www/webmail/snappymail/v/2.36.1/app/libraries/MailSo/Smtp/SmtpClient.php:579
Stack trace:
#0 /var/www/webmail/snappymail/v/2.36.1/app/libraries/MailSo/Smtp/SmtpClient.php(487): MailSo\Smtp\SmtpClient->validateResponse()
#1 /var/www/webmail/snappymail/v/2.36.1/app/libraries/MailSo/Smtp/SmtpClient.php(210): MailSo\Smtp\SmtpClient->sendRequestWithCheck()
#2 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Model/Account.php(264): MailSo\Smtp\SmtpClient->Login()
#3 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Model/Account.php(230): RainLoop\Model\Account->netClientLogin()
#4 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Actions/Messages.php(792): RainLoop\Model\Account->SmtpConnectAndLogin()
#5 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Actions/Messages.php(192): RainLoop\Actions->smtpSendMessage()
#6 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/ServiceActions.php(134): RainLoop\Actions->DoSendMessage()
#7 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Service.php(132): RainLoop\ServiceActions->ServiceJson()
#8 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Service.php(14): RainLoop\Service::RunResult()
#9 /var/www/webmail/snappymail/v/2.36.1/include.php(136): RainLoop\Service::Handle()
#10 /var/www/webmail/index.php(11): include('...')
#11 {main}
Next MailSo\Smtp\Exceptions\LoginBadCredentialsException: 334 HASH2== in /var/www/webmail/snappymail/v/2.36.1/app/libraries/MailSo/Smtp/SmtpClient.php:216
Stack trace:
#0 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Model/Account.php(264): MailSo\Smtp\SmtpClient->Login()
#1 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Model/Account.php(230): RainLoop\Model\Account->netClientLogin()
#2 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Actions/Messages.php(792): RainLoop\Model\Account->SmtpConnectAndLogin()
#3 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Actions/Messages.php(192): RainLoop\Actions->smtpSendMessage()
#4 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/ServiceActions.php(134): RainLoop\Actions->DoSendMessage()
#5 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Service.php(132): RainLoop\ServiceActions->ServiceJson()
#6 /var/www/webmail/snappymail/v/2.36.1/app/libraries/RainLoop/Service.php(14): RainLoop\Service::RunResult()
#7 /var/www/webmail/snappymail/v/2.36.1/include.php(136): RainLoop\Service::Handle()
#8 /var/www/webmail/index.php(11): include('...')
#9 {main}
[2024-05-09 12:57:29.700][f6d1dfb6] SMTP[INFO]: > QUIT\r\n
[2024-05-09 12:57:29.700][f6d1dfb6] SMTP[INFO]: < 235 2.7.0 nice\r\n@martinjanda i suspect the smtp client code is assuming the auth handshake is finished after the first hash. it is expecting 235 "auth ok" when it is getting "334 [hash2]". the code may be based on cram-md5 (with fewer roundtrips).
for comparison, see the code in imap client, which does another write & read before verify:
i'm not familiar enough with this code base or php to make changes (in a reasonable time frame).
the-djmaze
commented
2 months ago When i'm reading RFC 5802 correctly, there should only be one 334 (server challenge) response.
mjl-
commented
2 months ago https://datatracker.ietf.org/doc/html/rfc5802#section-5 has this as example:
C: n,,n=user,r=fyko+d2lbbFgONRv9qkxdawL
S: r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,s=QSXCR+Q6sek8bf92,
i=4096
C: c=biws,r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,
p=v0X8v3Bz2T0CJGbJQyF0X+HI4Ts=
S: v=rmF9pqV8S7suAoZWja4dJRkFsKQ=This is a session of mutt authenticating to mox (localserve):
C: AUTH SCRAM-SHA-256
S: 334
C: bixhPW1veEBsb2NhbGhvc3Qsbj1tb3hAbG9jYWxob3N0LHI9UDFxMGxWdzNaVXVNZmpMRngxSWR0QjRH
S: 334 cj1QMXEwbFZ3M1pVdU1makxGeDFJZHRCNEcvZWFDbE9IaXU0dkhQdmlPLHM9ZkJBRko2cGdTVXlwOTZudyxpPTQwOTY=
C: Yz1iaXhoUFcxdmVFQnNiMk5oYkdodmMzUXMscj1QMXEwbFZ3M1pVdU1makxGeDFJZHRCNEcvZWFDbE9IaXU0dkhQdmlPLHA9cFJlMi9Ca0x0MG5iZFAzOGVia3NuZ2dqZ2trTFRLalBjK0lIcVpOSHdHOD0=
S: 334 dj1EVWg3d0VURkFFQXBQMVV5MVBWcGxuMkV2Ry9SUDFYN3ZyZnptYytHMnd3PQ==
C:
S: 235 2.7.0 niceAnd this is the same session, but with the base64 of scram decoded so it looks more like what we're seeing in the RFC:
C: AUTH SCRAM-SHA-256
S: 334
C: n,a=mox@localhost,n=mox@localhost,r=P1q0lVw3ZUuMfjLFx1IdtB4G
S: 334 r=P1q0lVw3ZUuMfjLFx1IdtB4G/eaClOHiu4vHPviO,s=fBAFJ6pgSUyp96nw,i=4096
C: c=bixhPW1veEBsb2NhbGhvc3Qs,r=P1q0lVw3ZUuMfjLFx1IdtB4G/eaClOHiu4vHPviO,p=pRe2/BkLt0nbdP38ebksnggjgkkLTKjPc+IHqZNHwG8=
S: 334 v=DUh7wETFAEApP1Uy1PVpln2EvG/RP1X7vrfzmc+G2ww=
C:
S: 235 2.7.0 niceSo even before the first message from the client, the server will have sent the first 334. The last server message is also sent with a 334, and the client must send an empty response (scram has nothing for the client to send at that point, but the protocol must be finished).
It may be possible for the first client message after the AUTH command to be sent immediately as parameter in the AUTH command (SASL has a concept mode for that, I believe called immediate reply/response. IMAP has a capability SASL-IR that announces server support for it, but a quick search doesn't turn it up for SMTP).
Btw, I think SASL libraries are commonly designed/intended to be used without the protocol handling code (i.e. the imap/smtp clients/servers) knowing about the details of the SASL exchange. The SASL library would have an interface (API method) that indicates that there is another line to write (to the server). So as a client you could implement the sasl authentication as a loop that reads the next line from the sasl object, writes it to the server, then reads a (continuation/success/failure) line from the server. Those libraries would also do the selection of the authentication mechanism (plain, cram-md5, scram-* variants). This doesn't always work that well in practice, mox just handles SASL itself in its imap and smtp server.
the-djmaze
commented
2 months ago I couldn't find the following in the RFC nor SMTP implementation
334 "server-final-message"
So i assumed that "server-final-message" was equal to 235.
SMTP 334 response is the "Server challenge". the text part contains the Base64-encoded challenge
SMTP 235 response is "Authentication succeeded"
As the RFC 5802 "server-first-message" contains data for the challenge (nonce, salt, iterator). I assumed 334 was only used there.
But the "server-final-message" has a challenge for the client to verify.
The server verifies the nonce and the proof, verifies that the
authorization identity (if supplied by the client in the first
message) is authorized to act as the authentication identity, and,
finally, it responds with a "server-final-message", concluding the
authentication exchange.
The client then authenticates the server by computing the
ServerSignature and comparing it to the value sent by the server. If
the two are different, the client MUST consider the authentication
exchange to be unsuccessful, and it might have to drop the
connection.
Neustradamus
commented
1 month ago Thanks to:
SCRAM is more and more used and replaces old/unsecure CRAM-MD5/DIGEST-MD5.
Commits:
Describe the bug I get PHP Exception in log, when trying to log in to SMTP. In admin GUI I get Timeout.
I've tried no TLS, STARTTLS SSH/TLS with the same exception.
I'm not sure if this is a bug or if I'm doing something wrong.
To Reproduce Steps to reproduce the behavior:
Expected behavior Success log in to SMTP. User and pass works fine in Thunderbird etc.
Please complete the following information:
Debug/logging information
Log from mox server: