Hi,
mbsync 1.5.1 aborts with SIGABRT while logging in to outlook.office365.com.
This build has no XOAUTH2 support, so when the server offers AUTH=PLAIN,
mbsync falls back to it and tries to send a 2542-byte OAuth access token
(supplied via PassCmd) as a plaintext password. Base64-encoded that's
roughly 3.4 KB in the AUTHENTICATE PLAIN command, and it aborts while
building it.
Microsoft's frontend nodes don't all advertise the same capabilities, so
the outcome varies per connection. Two consecutive runs of the same
command, seconds apart:
AUTH=PLAIN AUTH=XOAUTH2 -> SIGABRT
AUTH=XOAUTH2 LOGINDISABLED -> clean "no acceptable authentication mechanism"
Version: isync 1.5.1 (Gentoo, aarch64)
Version: isync 1.5.1 (Gentoo, aarch64)
Output of `mbsync -a`:
C: 1/2 B: 6/6 F: +0/0 *0/0 #0/0 -0/0 N: +0/0 *0/0 #0/0 -0/0Fatal: buffer too
small. Please report a bug.
Output of `mbsync -V -D uf`:
catgirl@gentoo ~> mbsync -V -D uf
isync 1.5.1 called with: '-V' '-D' 'uf'
Reading configuration file /home/catgirl/.config/isyncrc
merge ops (in Channel 'uf'):
common: OP_EXPUNGE,OP_CREATE
far: XOP_HAVE_EXPUNGE,XOP_HAVE_CREATE
near:
=> far: OP_EXPUNGE,OP_CREATE,XOP_HAVE_EXPUNGE,XOP_HAVE_CREATE
=> near: OP_EXPUNGE,OP_CREATE
merge ops (in global config section):
common: OP_EXPUNGE,OP_CREATE
far: XOP_HAVE_EXPUNGE,XOP_HAVE_CREATE
near:
=> far: OP_EXPUNGE,OP_CREATE,XOP_HAVE_EXPUNGE,XOP_HAVE_CREATE
=> near: OP_EXPUNGE,OP_CREATE
channel ops (uf):
far:
near:
Channel uf
Opening far side store uf-remote...
F: [ 1] Enter connect_store
Resolving outlook.office365.com...
F: [ 1] Leave connect_store
Opening near side store uf-local...
N: [ 2] Enter connect_store
N: [ 2] Callback enter connect_store, sts=0
pattern '*' (effective '*'): Path, no INBOX
N: [ 3] Enter list_store, flags=2
N: [ 3] Callback enter list_store, sts=0
N: [ 3] Callback leave list_store
N: [ 3] Leave list_store
N: [ 2] Callback leave connect_store
N: [ 2] Leave connect_store
Connecting to outlook.office365.com ([2603:1036:303:7::2]:993)...
Connection is now encrypted
F: * OK The Microsoft Exchange IMAP4 service is ready. (BACKENDAUTHENTICATE)
[(redacted)]
F: >>> 1 CAPABILITY
F: * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS MOVE ID
UNSELECT CHILDREN IDLE NAMESPACE LITERAL+
F: 1 OK CAPABILITY completed.
Logging in...
Fatal: buffer too small. Please report a bug.
fish: Job 1, 'mbsync -V -D uf' terminated by signal SIGABRT (Abort)
catgirl@gentoo ~ [SIGABRT]> mbsync -V -D uf
isync 1.5.1 called with: '-V' '-D' 'uf'
Reading configuration file /home/catgirl/.config/isyncrc
merge ops (in Channel 'uf'):
common: OP_EXPUNGE,OP_CREATE
far: XOP_HAVE_EXPUNGE,XOP_HAVE_CREATE
near:
=> far: OP_EXPUNGE,OP_CREATE,XOP_HAVE_EXPUNGE,XOP_HAVE_CREATE
=> near: OP_EXPUNGE,OP_CREATE
merge ops (in global config section):
common: OP_EXPUNGE,OP_CREATE
far: XOP_HAVE_EXPUNGE,XOP_HAVE_CREATE
near:
=> far: OP_EXPUNGE,OP_CREATE,XOP_HAVE_EXPUNGE,XOP_HAVE_CREATE
=> near: OP_EXPUNGE,OP_CREATE
channel ops (uf):
far:
near:
Channel uf
Opening far side store uf-remote...
F: [ 1] Enter connect_store
Resolving outlook.office365.com...
F: [ 1] Leave connect_store
Opening near side store uf-local...
N: [ 2] Enter connect_store
N: [ 2] Callback enter connect_store, sts=0
pattern '*' (effective '*'): Path, no INBOX
N: [ 3] Enter list_store, flags=2
N: [ 3] Callback enter list_store, sts=0
N: [ 3] Callback leave list_store
N: [ 3] Leave list_store
N: [ 2] Callback leave connect_store
N: [ 2] Leave connect_store
Connecting to outlook.office365.com ([2603:1036:303:380a::2]:993)...
Connection is now encrypted
F: * OK Microsoft Exchange IMAP4 service ready. (redacted)
(tcpproxy/15.21.0315.000 BACKENDAUTHENTICATE) [(redacted)]
F: >>> 1 CAPABILITY
F: * CAPABILITY IMAP4 IMAP4rev1 AUTH=XOAUTH2 LOGINDISABLED SASL-IR UIDPLUS MOVE
ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+
F: 1 OK CAPABILITY completed.
Logging in...
IMAP error: server supports no acceptable authentication mechanism
F: [ 1] Callback enter connect_store, sts=3
F: Enter free_store
F: Leave free_store
N: Enter free_store
N: Leave free_store
F: [ 1] Callback leave connect_store
The access token is 2542 bytes; the base64-encoded SASL initial response is
roughly 3.4 KB.
Microsoft Entra access tokens are much larger than Gmail's and grow with
group and role claims, so institutional tenants produce the biggest ones.
That may be why this hasn't come up before.
Reproduces whenever the server advertises AUTH=PLAIN, which is roughly
half of connections. My config is arguably wrong (no working XOAUTH2
mechanism available), but aborting rather than failing gracefully on an
oversized credential seems worth fixing. Happy to provide a backtrace or test
a patch.
Thanks,
Vera
_______________________________________________
isync-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/isync-devel
