popa3d-users - Re: Outlook 2002 duplicate emails

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Sat, 1 Mar 2003 01:20:21 +0300
From: Solar Designer <solar@...nwall.com>
To: popa3d-users@...ts.openwall.com
Subject: Re: Outlook 2002 duplicate emails

On Fri, Feb 28, 2003 at 03:40:06PM -0600, Thomas Hays wrote:
> Postfix behaviour does differ from Sendmail in this case. I won't even
> try to guess which is the "correct" behaviour, however, it appears
> that Postfix isn't planning on changing if I read their FAQ
> correctly:
> http://www.postfix.org/faq.html#duplicate

Well, what we need is to ensure that if duplicate messages are
produced, they are still different by at least one of the
locally-generated headers.

> Based on this, could we not tack on an extra 8 (or 16 or whatever)
> characters that would make the message unique. I have a patch that
> does this and seems to work. Basically, I modified
> pop_trans_list_or_uidl_all() and added a counter to the "for" loop and
> append that to the hash. For example, I now have hashes that look
> like:
> 80c3fb08daf1feed00000000
> 80c3fb08daf1feed00000001

This breaks another property which is even more strictly required from
UIDL: an ID for a message must not change for as long as the message
is in the mailbox.  With your example above, if one deletes the first
message and closes the POP3 session, the second message will change
its "unique" ID to that previously used by the first message.  This is
even worse than what we have currently: not only the second message's
ID not unique (it will match a previously used one), but also it has
changed across sessions (a real RFC violation)!

I am quite willing to believe that it helps with Outlook, but only
when no premature disconnects occur.

> > BTW, I have a qmail 1.03 patch which solves this by adding an
> > X-Delivery-ID: header, which popa3d is prepared to handle.  I should
> > probably make it available.
> 
> It would be great to see this patch if what I mentioned above isn't
> good.

Attached.

Please let us know if you produce a similar patch for Postfix,
preferably for the latest stable version.

-- 
/sd

--- qmail-1.03/qmail-local.c.orig	Mon Jun 15 14:53:16 1998
+++ qmail-1.03/qmail-local.c	Fri Mar 22 09:58:45 2002
@@ -58,6 +58,7 @@
 stralloc rpline = {0};
 stralloc envrecip = {0};
 stralloc dtline = {0};
+stralloc diline = {0};
 stralloc qme = {0};
 stralloc ueo = {0};
 stralloc cmds = {0};
@@ -196,6 +197,7 @@
  if (substdio_put(&ssout,ufline.s,ufline.len)) goto writeerrs;
  if (substdio_put(&ssout,rpline.s,rpline.len)) goto writeerrs;
  if (substdio_put(&ssout,dtline.s,dtline.len)) goto writeerrs;
+ if (substdio_put(&ssout,diline.s,diline.len)) goto writeerrs;
  for (;;)
   {
    if (getln(&ss,&messline,&match,'\n') != 0) 
@@ -458,6 +460,7 @@
  datetime_sec starttime;
  int flagforwardonly;
  char *x;
+ char strnum[FMT_ULONG];
 
  umask(077);
  sig_pipeignore();
@@ -512,6 +515,12 @@
  if (!stralloc_copy(&foo,&dtline)) temp_nomem();
  if (!stralloc_0(&foo)) temp_nomem();
  if (!env_put2("DTLINE",foo.s)) temp_nomem();
+
+ if (!stralloc_copys(&diline,"X-Delivery-ID: ")) temp_nomem();
+ if (!stralloc_catb(&diline,strnum,fmt_ulong(strnum,(unsigned long) now()))) temp_nomem();
+ if (!stralloc_cats(&diline,".")) temp_nomem();
+ if (!stralloc_catb(&diline,strnum,fmt_ulong(strnum,(unsigned long) getpid()))) temp_nomem();
+ if (!stralloc_cats(&diline,"\n")) temp_nomem();
 
  if (flagdoit)
    bouncexf();