[PATCH 1/3] imap: Restrict COMPRESS to DEFLATE only

cmd_compress() and the imap-login proxy side channel looked up any
registered compression handler by name, so a client could request e.g.
COMPRESS ZSTD even though only COMPRESS=DEFLATE is advertised (RFC 4978).

Non-DEFLATE algorithms can require far more memory to decompress (a zstd
decoder alone can hold a 16+ MB window per connection versus ~40 KB for
inflate). This matters now that imap-login handles COMPRESS for proxied
connections: an attacker opening many connections could drive the shared
login process into its vsz_limit and crash it, affecting all clients on
that process.

Only accept DEFLATE on both the backend and the login proxy path.

Gbp-Pq: Name 0001-imap-Restrict-COMPRESS-to-DEFLATE-only.patch

diff --git a/src/imap-login/imap-proxy.c b/src/imap-login/imap-proxy.c
index 15c5f800af018d62f6ad6d73f5b5effb1a554dba..d76a728721e7efa2e42ab97c3cb6b6418de5e9ce 100644 (file)
--- a/src/imap-login/imap-proxy.c
+++ b/src/imap-login/imap-proxy.c
@@ -606,13 +606,14 @@ proxy_side_cmd_compress(struct client *client, const char *const *args,
                login_proxy_get_client_ostream(client->login_proxy);
        const struct compression_handler *handler;
        int ret = compression_lookup_handler(t_str_lcase(args[0]), &handler);
-       if (ret <= 0) {
-               /* IMAP backend normally checks this already. If we get here,
-                  there is a mismatch between what algorithms proxy and
-                  backend supports. */
+       /* Only DEFLATE is permitted. The IMAP backend restricts this already;
+          enforce it here too, since imap-login handles COMPRESS for proxied
+          connections and non-DEFLATE algorithms can be far more memory-heavy
+          to decompress. */
+       if (ret <= 0 || strcmp(handler->name, "deflate") != 0) {
                o_stream_nsend_str(client_output, t_strdup_printf(
                        "%s NO %s compression mechanism\r\n", args[1],
-                       ret == 0 ? "Unsupported" : "Unknown"));
+                       ret < 0 ? "Unknown" : "Unsupported"));
                return 0;
        }
 

diff --git a/src/imap/cmd-compress.c b/src/imap/cmd-compress.c
index cf08c66568f5e42ab042f2c739a4652f6e875a4a..363d050f474379c389e0570bc589ab504f299010 100644 (file)
--- a/src/imap/cmd-compress.c
+++ b/src/imap/cmd-compress.c
@@ -67,10 +67,14 @@ bool cmd_compress(struct client_command_context *cmd)
                return TRUE;
        }
        int ret = compression_lookup_handler(t_str_lcase(mechanism), &handler);
-       if (ret <= 0) {
+       /* Only DEFLATE is advertised (RFC 4978) and accepted here. Other
+          algorithms (e.g. zstd) can require far more memory to decompress,
+          which especially matters now that imap-login can handle COMPRESS for
+          proxied connections and an attacker could open many of them. */
+       if (ret <= 0 || strcmp(handler->name, "deflate") != 0) {
                const char * tagline =
                        t_strdup_printf("NO %s compression mechanism",
-                                       ret == 0 ? "Unsupported" : "Unknown");
+                                       ret < 0 ? "Unknown" : "Unsupported");
                client_send_tagline(cmd, tagline);
                return TRUE;
        }