Tests: POP3 commands sent to backend - #93
Open
VadimZhestikov wants to merge 1 commit into
Open
Conversation
9 tasks
Credentials are copied verbatim into the USER and PASS command lines sent to the backend. A CR or LF in a credential, which is only reachable with SASL, is relayed as an additional command line into the authenticated backend session. The tests for such credentials are marked TODO, as the fix is not yet released.
VadimZhestikov
force-pushed
the
test/mail-pop3-relay-crlf
branch
from
August 4, 2026 17:08
b929d2d to
9733da1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tests for the POP3 command lines the mail proxy sends to the backend.
Credentials are copied verbatim into
USER <login>andPASS <passwd>.These lines are terminated by CRLF and POP3 has no syntax that can carry a CR
or LF inside a command argument, so such a byte in a credential -- reachable
only with SASL, since plain
USER/PASSvalues come from a parsed commandline -- turns one command into two command lines to the backend.
The test
New
mail_proxy_pop3.tcovers both the login path (USER) and the passwordpath (
PASS), plus a baseline that a normalAUTH PLAINlogin reaches thebackend with no extra command line.
Two notes on how it is built:
The backend daemon answers exactly one response per command nginx sends and
records any other line silently, retrievable by the client with
XEXTRAonce logged in, since nginx proxies transparently from that point (the same
idiom as
XPROXYinTest::Nginx::SMTP). Recording rather than answeringis what keeps the assertions independent of response timing: the shared
pop3_test_daemonanswers-ERR unknown commandto the injected line, andwhether that reply reaches nginx together with the preceding one or on its
own changes what the client ends up seeing.
The
auth_httpstub accepts unconditionally. The precondition for relayingsuch a credential is an auth server that accepts it, and the behaviour under
test is at the relay layer, independent of auth policy.
The two credential cases are marked
TODO, as the fix is not yet released.Testing
Verified against a patched and an unpatched binary:
the suite stays green through
TODO.mail_pop3.t,mail_imap.t,mail_smtp.t,mail_smtp_xclient.tandmail_proxy_protocol.t.Code PR: nginx/nginx#1620