I Found Where Lots of Mail Has Been Going (Bug?)

[Jerry Malcolm <te...@malcolms.com>]

When storing mail, the target account and folder are passed in to one of 
the three mail-store mailets.  If the folder doesn't exist on the target 
account, it makes sense that this folder be created automatically.  I 
don't have a problem with that.  However, if the target account doesn't 
exist, a completely new target account mailbox is created even though 
there is not a matching user account.  Granted, in a perfect world, a 
non-existent target account should not be passed in.  But it is 
happening (a lot). I plan to track back and figure that out next.  But 
currently, I have over 1000 new mailboxes created, mostly from spammers.

MailBoxAppender immediately tries to create the mailbox if it doesn't 
exist.  StoreMailBoxManager checks for a valid mailbox name, but does 
NOT check to see if an account exists for this mailbox.  It then creates 
the mailbox and downstream code dutifully stores the requested email in 
this 'orphan' mailbox that has no way to be accessed.

Question: I assume that there is no reason a mailbox should be created 
for "WeAreSpammers@Spammers.com" just because some upstream code asked 
for it.  I assume that MailBoxAppender 'should' receive an exception in 
this case.  Is this correct?

Question 2: Assuming I am correct in my assumption, I can fix it by 
adding a check if there is an actual user matching the mailbox.  But 
with all of the implementation variations, I don't know the best 
'abstract' way of checking if a user name is valid that will work across 
all variations.  So if someone can tell me the correct way to check a 
user name, I'll make the change.

In the meantime, for users who can't find mail.... (Mark Gordon, et al) 
should check to see if you have a bunch of orphaned mailboxes in your 
database.

BTW.... This could explain why I was getting 'Read-only' mailbox errors 
which was actually 'mailbox doesn't exist'.  I was only getting those 
errors when there was a capitalization error in the account name.  I 
suspect that somehow mailbox names are case-normalized and the create 
failed because the normalized mailbox name existed.  But when the 
appender tried to write to the mailbox, it was case-sensitive, so the 
mailbox it was seeking still didn't exist.  However, when the 
create-mailbox was for a completely random account name, the create 
worked, and there was no error.

Still a problem with upstream sending in mixed case target account names 
that don't match users.  I'll look into that soon.

Jerry


---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org

Re: I Found Where Lots of Mail Has Been Going (Bug?)

[Tellier Benoit <bt...@apache.org>]

Hi Jerry, answers inlined.

Cheers,

Benoit

On 28/10/2019 00:38, Jerry Malcolm wrote:
> When storing mail, the target account and folder are passed in to one of
> the three mail-store mailets.  If the folder doesn't exist on the target
> account, it makes sense that this folder be created automatically.  I
> don't have a problem with that.  However, if the target account doesn't
> exist, a completely new target account mailbox is created even though
> there is not a matching user account.  Granted, in a perfect world, a
> non-existent target account should not be passed in.  But it is
> happening (a lot). I plan to track back and figure that out next.  But
> currently, I have over 1000 new mailboxes created, mostly from spammers.
> 
> MailBoxAppender immediately tries to create the mailbox if it doesn't
> exist.  StoreMailBoxManager checks for a valid mailbox name, but does
> NOT check to see if an account exists for this mailbox.  It then creates
> the mailbox and downstream code dutifully stores the requested email in
> this 'orphan' mailbox that has no way to be accessed.
> 
> Question: I assume that there is no reason a mailbox should be created
> for "WeAreSpammers@Spammers.com" just because some upstream code asked
> for it.  I assume that MailBoxAppender 'should' receive an exception in
> this case.  Is this correct?

More precisely you should not attempt to store this mailet.

You can do this by specifying a "IsLocalRecipient" as a matcher for
LocalDelivery.

> 
> Question 2: Assuming I am correct in my assumption, I can fix it by
> adding a check if there is an actual user matching the mailbox.  But
> with all of the implementation variations, I don't know the best
> 'abstract' way of checking if a user name is valid that will work across
> all variations.  So if someone can tell me the correct way to check a
> user name, I'll make the change.

I think that the correct way of doing this is with a matcher.

> 
> In the meantime, for users who can't find mail.... (Mark Gordon, et al)
> should check to see if you have a bunch of orphaned mailboxes in your
> database.
> 
> BTW.... This could explain why I was getting 'Read-only' mailbox errors
> which was actually 'mailbox doesn't exist'.  I was only getting those
> errors when there was a capitalization error in the account name.  I
> suspect that somehow mailbox names are case-normalized and the create
> failed because the normalized mailbox name existed.  But when the
> appender tried to write to the mailbox, it was case-sensitive, so the
> mailbox it was seeking still didn't exist.  However, when the
> create-mailbox was for a completely random account name, the create
> worked, and there was no error.
> 
> Still a problem with upstream sending in mixed case target account names
> that don't match users.  I'll look into that soon.

Case normalization seems like to be a real issue that should be
addressed, yes...

> 
> Jerry
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
> For additional commands, e-mail: server-dev-help@james.apache.org
> 

---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org