Skip to content

Tests: POP3 commands sent to backend - #93

Open
VadimZhestikov wants to merge 1 commit into
nginx:masterfrom
VadimZhestikov:test/mail-pop3-relay-crlf
Open

Tests: POP3 commands sent to backend#93
VadimZhestikov wants to merge 1 commit into
nginx:masterfrom
VadimZhestikov:test/mail-pop3-relay-crlf

Conversation

@VadimZhestikov

@VadimZhestikov VadimZhestikov commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Tests for the POP3 command lines the mail proxy sends to the backend.

Credentials are copied verbatim into USER <login> and PASS <passwd>.
These lines are terminated by CRLF and POP3 has no syntax that can carry a CR
or LF inside a command argument, so such a byte in a credential -- reachable
only with SASL, since plain USER/PASS values come from a parsed command
line -- turns one command into two command lines to the backend.

The test

New mail_proxy_pop3.t covers both the login path (USER) and the password
path (PASS), plus a baseline that a normal AUTH PLAIN login reaches the
backend with no extra command line.

Two notes on how it is built:

  • The backend daemon answers exactly one response per command nginx sends and
    records any other line silently, retrievable by the client with XEXTRA
    once logged in, since nginx proxies transparently from that point (the same
    idiom as XPROXY in Test::Nginx::SMTP). Recording rather than answering
    is what keeps the assertions independent of response timing: the shared
    pop3_test_daemon answers -ERR unknown command to the injected line, and
    whether that reply reaches nginx together with the preceding one or on its
    own changes what the client ends up seeing.

  • The auth_http stub accepts unconditionally. The precondition for relaying
    such a credential is an auth server that accepts it, and the behaviour under
    test is at the relay layer, independent of auth policy.

The two credential cases are marked TODO, as the fix is not yet released.

Testing

Verified against a patched and an unpatched binary:

  • unpatched -- both cases fail, the login succeeds and the CR/LF is relayed;
    the suite stays green through TODO.
  • patched -- both cases pass.
  • the full mail suite passes on the patched binary (277 tests), including
    mail_pop3.t, mail_imap.t, mail_smtp.t, mail_smtp_xclient.t and
    mail_proxy_protocol.t.

Code PR: nginx/nginx#1620

Credentials are copied verbatim into the USER and PASS command lines
sent to the backend.  A CR or LF in a credential, which is only
reachable with SASL, is relayed as an additional command line into the
authenticated backend session.

The tests for such credentials are marked TODO, as the fix is not yet
released.
@VadimZhestikov
VadimZhestikov force-pushed the test/mail-pop3-relay-crlf branch from b929d2d to 9733da1 Compare August 4, 2026 17:08
@VadimZhestikov
VadimZhestikov requested a review from pluknet August 4, 2026 17:15
@VadimZhestikov VadimZhestikov self-assigned this Aug 4, 2026
@sindhushiv sindhushiv moved this from New to In Review in NGINX OSS Unified Workspace Aug 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: In Review

Development

Successfully merging this pull request may close these issues.

3 participants