From: Timo Sirainen Date: Fri, 26 Jun 2026 05:50:10 +0000 (+0000) Subject: submission-login: submission-proxy - Handle multi-line backend AUTH reply X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fb4bfcdba76564072fa2a933e683bea9d3e718e9;p=thirdparty%2Fdovecot%2Fcore.git submission-login: submission-proxy - Handle multi-line backend AUTH reply In the SUBMISSION_PROXY_AUTHENTICATE state a non-334 reply line that is not an invalid line ran i_assert(proxy_reply == NULL) and then created proxy_reply, returning early (return 0) for a non-final line without clearing it. proxy_reply is only reset on connection reset, so a backend answering the proxied AUTH with a multi-line reply (e.g. a two-line '535-...' / '535 ...' rejection) re-entered this state with proxy_reply already set and tripped the assert, i_panic()ing the submission-login process - a deterministic DoS triggerable by a malicious/compromised backend. Create proxy_reply only on the first line and append each subsequent line's text to it. --- diff --git a/src/submission-login/submission-proxy.c b/src/submission-login/submission-proxy.c index 3a2e1f84e0..296e7a585f 100644 --- a/src/submission-login/submission-proxy.c +++ b/src/submission-login/submission-proxy.c @@ -651,9 +651,15 @@ int submission_proxy_parse_line(struct client *client, const char *line) return 0; } - i_assert(subm_client->proxy_reply == NULL); - subm_client->proxy_reply = smtp_server_reply_create( - command, status, enh_code); + /* The backend may answer the proxied AUTH with a multi-line + reply, in which case this callback is invoked once per line + with the reply still pending (!last_line). Create the reply + on the first line and append the text of each subsequent + line. */ + if (subm_client->proxy_reply == NULL) { + subm_client->proxy_reply = smtp_server_reply_create( + command, status, enh_code); + } smtp_server_reply_add_text(subm_client->proxy_reply, text); if (!last_line)