Tuesday, June 13, 2006

up-imapproxyd and Horde/IMP

up-imapproxy is, well, an IMAP proxy. The idea is that you put it between your IMAP server and your webmail client to reduce the load that running a non-stateful application like a webmail client puts on your server. All it does is allow you to re-use connections.

We use up-imapproxy with Horde's IMP and for the most part it works very well. Recently, however, it started crashing at random intervals. There's never really anything useful in the logs, except they consistently seem to log lines like:

Jun 13 09:23:32 hippo in.imapproxyd[64368]: LOGIN: '"' (127.0.0.1:59934) failed: non-OK server response to LOGIN command

immediately before the crash.

After chasing down some false leads (we'd recently upgraded the machine from FreeBSD 5.4 to 6.1), I discovered a security advisory on up-imapproxy's web site. It seems there's a bug in the way it handles string literals. Unfortunately, as the advisory also notes, as of IMP 4.1.1, Horde have started using string literals in certain cases. In other words, IMP 4.1.1 will crash your imapproxy. Not a good situation.

As it turns out, we just upgraded to IMP 4.1.1. Not wanting to downgrade, the suggested workaround, I started looking for another solution. The immediate idea was to change IMAP proxy — FreeBSD has one from the Catholic University at Leuven in ports. When it turned out that it was going to be complicated to switch, I started looking for a simpler solution.

The effects of this bug are simply that the IMAP proxy crash; that got me thinking. All we need to do is restart it when it does. That's easy in our case because we already have daemontools installed on the machine, so we can use supervise. Implementing this also turned out to be minor.

All I needed to do was create a service directory, and a run script that started in.imapproxyd and then reconfigure up-imapproxyd to run in the foreground rather than forking (so supervise can monitor it). This is a one-line config change: foreground_mode yes in imapproxyd.conf.

So now we have a buggy IMAP proxy that can be DoSed (albeit only from localhost or the webmail client), but which'll restart itself a second later. Clients hardly notice this, because Horde expects to have to reconnect. It's a fairly neat workaround, so I thought I'd post it here in case anyone else was trying to solve this.

posted by guy at: 20:00 SAST | path: /systems | permanent link