From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Sat, 4 Jul 2026 21:57:15 +0000 (+0000)
Subject: [PATCH 1/3] imap: Restrict COMPRESS to DEFLATE only
X-Git-Tag: archive/raspbian/1%2.4.1+dfsg1-6+rpi1+deb13u7^2~121
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=588501febebf1ad5f50cc4c7d699145487aa117f;p=dovecot.git

[PATCH 1/3] imap: Restrict COMPRESS to DEFLATE only

cmd_compress() and the imap-login proxy side channel looked up any
registered compression handler by name, so a client could request e.g.
COMPRESS ZSTD even though only COMPRESS=DEFLATE is advertised (RFC 4978).

Non-DEFLATE algorithms can require far more memory to decompress (a zstd
decoder alone can hold a 16+ MB window per connection versus ~40 KB for
inflate). This matters now that imap-login handles COMPRESS for proxied
connections: an attacker opening many connections could drive the shared
login process into its vsz_limit and crash it, affecting all clients on
that process.

Only accept DEFLATE on both the backend and the login proxy path.

Gbp-Pq: Name 0001-imap-Restrict-COMPRESS-to-DEFLATE-only.patch
---

diff --git a/src/imap-login/imap-proxy.c b/src/imap-login/imap-proxy.c
index 15c5f80..d76a728 100644
--- a/src/imap-login/imap-proxy.c
+++ b/src/imap-login/imap-proxy.c
@@ -606,13 +606,14 @@ proxy_side_cmd_compress(struct client *client, const char *const *args,
 		login_proxy_get_client_ostream(client->login_proxy);
 	const struct compression_handler *handler;
 	int ret = compression_lookup_handler(t_str_lcase(args[0]), &handler);
-	if (ret <= 0) {
-		/* IMAP backend normally checks this already. If we get here,
-		   there is a mismatch between what algorithms proxy and
-		   backend supports. */
+	/* Only DEFLATE is permitted. The IMAP backend restricts this already;
+	   enforce it here too, since imap-login handles COMPRESS for proxied
+	   connections and non-DEFLATE algorithms can be far more memory-heavy
+	   to decompress. */
+	if (ret <= 0 || strcmp(handler->name, "deflate") != 0) {
 		o_stream_nsend_str(client_output, t_strdup_printf(
 			"%s NO %s compression mechanism\r\n", args[1],
-			ret == 0 ? "Unsupported" : "Unknown"));
+			ret < 0 ? "Unknown" : "Unsupported"));
 		return 0;
 	}
 
diff --git a/src/imap/cmd-compress.c b/src/imap/cmd-compress.c
index cf08c66..363d050 100644
--- a/src/imap/cmd-compress.c
+++ b/src/imap/cmd-compress.c
@@ -67,10 +67,14 @@ bool cmd_compress(struct client_command_context *cmd)
 		return TRUE;
 	}
 	int ret = compression_lookup_handler(t_str_lcase(mechanism), &handler);
-	if (ret <= 0) {
+	/* Only DEFLATE is advertised (RFC 4978) and accepted here. Other
+	   algorithms (e.g. zstd) can require far more memory to decompress,
+	   which especially matters now that imap-login can handle COMPRESS for
+	   proxied connections and an attacker could open many of them. */
+	if (ret <= 0 || strcmp(handler->name, "deflate") != 0) {
 		const char * tagline =
 			t_strdup_printf("NO %s compression mechanism",
-					ret == 0 ? "Unsupported" : "Unknown");
+					ret < 0 ? "Unknown" : "Unsupported");
 		client_send_tagline(cmd, tagline);
 		return TRUE;
 	}