Bug#664249: mutt: Error allocating SASL connection when using imaps

[Darshaka Pathirana]

Package: mutt
Version: 1.5.21-5
Severity: important

Dear Maintainer,

I tried to configure mutt (on Debian/wheezy) to connect to my IMAP(S)-Server
(using dovecot on Debian/Squeeze). I therefor copied my working mutt
configuration file from my notebook running Debian/Squeeze.

Mutt then asked me to accept my (self-signed) certificate. Which I accepted
(always). The certificate was saved and the status line showed:

SSL/TLS connection using TLS1.0 (DHE-RSA/AES-128-CBC/SHA1)

and then showed the error:

Error allocating SASL connection

I also stripped down everything else just leaving this:

set spoolfile="imaps://$MYUSERNAME@imap.$MYIMAPSERVER.org/INBOX"

And also tried various combinations of

set ssl_starttls=yes|no
set ssl_force_tls=yes|no

without success.

Do you have any suggestions to pin down the problem? Please note that the given
configuration file used to work with mutt in Debian/Squeeze
(v1.5.20-9+squeeze2). I did NOT try the squeeze-backport (yet).

Thx for any help.

Regards,
- Darsha


-- Package-specific info:
Mutt 1.5.21 (2010-09-15)
Copyright (C) 1996-2009 Michael R. Elkins and others.
Mutt comes with ABSOLUTELY NO WARRANTY; for details type `mutt -vv'.
Mutt is free software, and you are welcome to redistribute it
under certain conditions; type `mutt -vv' for details.

System: Linux 3.2.0-1-amd64 (x86_64)
ncurses: ncurses 5.9.20110404 (compiled with 5.9)
libidn: 1.23 (compiled with 1.20)
hcache backend: tokyocabinet 1.4.37
Compile options:
-DOMAIN
+DEBUG
-HOMESPOOL +USE_SETGID +USE_DOTLOCK +DL_STANDALONE +USE_FCNTL -USE_FLOCK
+USE_POP +USE_IMAP +USE_SMTP
-USE_SSL_OPENSSL +USE_SSL_GNUTLS +USE_SASL +USE_GSS +HAVE_GETADDRINFO
+HAVE_REGCOMP -USE_GNU_REGEX
+HAVE_COLOR +HAVE_START_COLOR +HAVE_TYPEAHEAD +HAVE_BKGDSET
+HAVE_CURS_SET +HAVE_META +HAVE_RESIZETERM
+CRYPT_BACKEND_CLASSIC_PGP +CRYPT_BACKEND_CLASSIC_SMIME +CRYPT_BACKEND_GPGME
-EXACT_ADDRESS -SUN_ATTACHMENT
+ENABLE_NLS -LOCALES_HACK +COMPRESSED +HAVE_WC_FUNCS +HAVE_LANGINFO_CODESET +HAVE_LANGINFO_YESEXPR
+HAVE_ICONV -ICONV_NONTRANS +HAVE_LIBIDN +HAVE_GETSID +USE_HCACHE
-ISPELL
SENDMAIL="/usr/sbin/sendmail"
MAILPATH="/var/mail"
PKGDATADIR="/usr/share/mutt"
SYSCONFDIR="/etc"
EXECSHELL="/bin/sh"
MIXMASTER="mixmaster"
To contact the developers, please mail to <mutt...@mutt.org>.
To report a bug, please visit http://bugs.mutt.org/.

misc/am-maintainer-mode
features/ifdef
features/xtitles
features/trash-folder
features/purge-message
features/imap_fast_trash
features/sensible_browser_position
features-old/patch-1.5.4.vk.pgp_verbose_mime
features/compressed-folders
features/compressed-folders.debian
debian-specific/Muttrc
debian-specific/Md.etc_mailname_gethostbyname.diff
debian-specific/use_usr_bin_editor.diff
debian-specific/correct_docdir_in_man_page.diff
debian-specific/dont_document_not_present_features.diff
debian-specific/document_debian_defaults
debian-specific/assumed_charset-compat
debian-specific/467432-write_bcc.patch
debian-specific/566076-build_doc_adjustments.patch
misc/define-pgp_getkeys_command.diff
misc/gpg.rc-paths
misc/smime.rc
upstream/531430-imapuser.patch
upstream/537818-emptycharset.patch
upstream/543467-thread-segfault.patch
upstream/542817-smimekeys-tmpdir.patch
upstream/548577-gpgme-1.2.patch
upstream/553321-ansi-escape-segfault.patch
upstream/568295-references.patch
upstream/547980-smime_keys-chaining.patch
upstream/528233-readonly-open.patch
upstream/228671-pipe-mime.patch
upstream/383769-score-match.patch
upstream/578087-header-strchr.patch
upstream/603288-split-fetches.patch
upstream/537061-dont-recode-saved-attachments.patch
upstream/608706-fix-spelling-errors.patch
upstream/620854-pop3-segfault.patch
upstream/611412-bts-regexp.patch
upstream/624058-gnutls-deprecated-set-priority.patch
upstream/624085-gnutls-deprecated-verify-peers.patch
upstream/584138-mx_update_context-segfault.patch
upstream/619216-gnutls-CN-validation.patch
upstream/611410-no-implicit_autoview-for-text-html.patch
upstream/path_max
mutt.org

-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash

Versions of packages mutt depends on:
ii libc6 2.13-27
ii libcomerr2 1.42.1-2
ii libgnutls26 2.12.16-1
ii libgpg-error0 1.10-3
ii libgpgme11 1.2.0-1.4
ii libgssapi-krb5-2 1.10+dfsg~beta1-2
ii libidn11 1.23-2
ii libk5crypto3 1.10+dfsg~beta1-2
ii libkrb5-3 1.10+dfsg~beta1-2
ii libncursesw5 5.9-4
ii libsasl2-2 2.1.25.dfsg1-4
ii libtokyocabinet8 1.4.37-9

Versions of packages mutt recommends:
ii libsasl2-modules 2.1.25.dfsg1-4
ii locales 2.13-27
ii mime-support 3.52-1
ii postfix [mail-transport-agent] 2.8.7-1

Versions of packages mutt suggests:
pn aspell 0.60.7~20110707-1
pn ca-certificates 20120212
pn gnupg 1.4.11-3
pn mixmaster <none>
pn openssl 1.0.0h-1
pn urlview <none>

Versions of packages mutt is related to:
pn mutt 1.5.21-5
pn mutt-dbg <none>
pn mutt-patched <none>

-- no debconf information



--
To UNSUBSCRIBE, email to debian-bugs-...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org

[Jonathan Nieder]

Hi Darsha,

Darshaka Pathirana wrote:

> Mutt then asked me to accept my (self-signed) certificate. Which I accepted
> (always). The certificate was saved and the status line showed:
>
> SSL/TLS connection using TLS1.0 (DHE-RSA/AES-128-CBC/SHA1)
>
> and then showed the error:
>
> Error allocating SASL connection
>
> I also stripped down everything else just leaving this:
>
> set spoolfile="imaps://$MYUSERNAME@imap.$MYIMAPSERVER.org/INBOX"

If you run 'mutt -d 2' and try again, does ~/.muttdebug0 say anything
interesting?

Curious,
Jonathan

[Darshaka Pathirana]

Hi Jonathan!

On 03/17/2012 02:55 AM, Jonathan Nieder wrote:
> Darshaka Pathirana wrote:
>
>> Mutt then asked me to accept my (self-signed) certificate. Which I accepted
>> (always). The certificate was saved and the status line showed:
>>
>> SSL/TLS connection using TLS1.0 (DHE-RSA/AES-128-CBC/SHA1)
>>
>> and then showed the error:
>>
>> Error allocating SASL connection
>>
>> I also stripped down everything else just leaving this:
>>
>> set spoolfile="imaps://$MYUSERNAME@imap.$MYIMAPSERVER.org/INBOX"
>
> If you run 'mutt -d 2' and try again, does ~/.muttdebug0 say anything
> interesting?
>

This is the relevant part of the debug-log:

[2012-03-17 03:05:07] Reading imaps://$MYUSERNAME@imap.$MYIMAPSERVER.org/INBOX...
[2012-03-17 03:05:07] Looking up imap.$MYIMAPSERVER.org...
[2012-03-17 03:05:07] Connecting to imap.$MYIMAPSERVER.org...
[2012-03-17 03:05:08] SSL/TLS connection using TLS1.0 (DHE-RSA/AES-128-CBC/SHA1)
[2012-03-17 03:05:09] Connected to imap.$MYIMAPSERVER.org:993 on fd=4
[2012-03-17 03:05:09] 4< * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN] Dovecot ready.
[2012-03-17 03:05:09] imap_authenticate: Using any available method.
[2012-03-17 03:05:09] SASL local ip: 10.0.0.188;58868, remote ip:xxx.yyy.zzz.254;993
[2012-03-17 03:05:09] Error allocating SASL connection
[2012-03-17 03:05:09] imap_auth_sasl: Error allocating SASL connection.
[2012-03-17 03:05:11] Closing connection to imap.$MYIMAPSERVER.org...
[2012-03-17 03:05:11] 4> a0000 LOGOUT^M
[2012-03-17 03:05:11] 4< * BYE Logging out
[2012-03-17 03:05:11] Handling BYE
[2012-03-17 03:05:11] 4< a0000 OK Logout completed.

Does not seem very helpful. What do you think?

Thx && Regards,
- Darsha

[Jonathan Nieder]

Darshaka Pathirana wrote:

> Reading imaps://$MYUSERNAME@imap.$MYIMAPSERVER.org/INBOX...
> Looking up imap.$MYIMAPSERVER.org...
> Connecting to imap.$MYIMAPSERVER.org...

> SSL/TLS connection using TLS1.0 (DHE-RSA/AES-128-CBC/SHA1)

> Connected to imap.$MYIMAPSERVER.org:993 on fd=4

> 4< * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN] Dovecot ready.

> imap_authenticate: Using any available method.

> SASL local ip: 10.0.0.188;58868, remote ip:xxx.yyy.zzz.254;993

> Error allocating SASL connection

Thanks.

sasl_client_new() was called like so:

rc = sasl_client_new("imap", "imap.$MYIMAPSERVER.org",
"10.0.0.188;58868", "xxx.yyy.zzz.2554;993",
mutt_sasl_get_callbacks(&conn->account), 0, saslconn);

It didn't return SASL_OK. Maybe it returned SASL_NOMECH instead.

- does "ldd /usr/bin/mutt" show it pointing to the right sasl lib?
- based on tracing with "ltrace -o /tmp/log mutt", what does
sasl_client_new actually return?
- what versions does "dpkg-query -W libsasl2-\*" show?
- are other apps using libsasl (like subversion) working?

Sorry I have no better ideas.

Hope that helps,
Jonathan

[Darshaka Pathirana]

Hi Jonathan!

On Fri, Mar 16, 2012 at 10:25:38PM -0500, Jonathan Nieder wrote:
> Darshaka Pathirana wrote:
>
>> Reading imaps://$MYUSERNAME@imap.$MYIMAPSERVER.org/INBOX...
>> Looking up imap.$MYIMAPSERVER.org...
>> Connecting to imap.$MYIMAPSERVER.org...
>> SSL/TLS connection using TLS1.0 (DHE-RSA/AES-128-CBC/SHA1)
>> Connected to imap.$MYIMAPSERVER.org:993 on fd=4
>> 4< * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN] Dovecot ready.
>> imap_authenticate: Using any available method.
>> SASL local ip: 10.0.0.188;58868, remote ip:xxx.yyy.zzz.254;993
>> Error allocating SASL connection
>
> Thanks.

Thank You for your help!

> sasl_client_new() was called like so:
>
> rc = sasl_client_new("imap", "imap.$MYIMAPSERVER.org",
> "10.0.0.188;58868", "xxx.yyy.zzz.2554;993",
> mutt_sasl_get_callbacks(&conn->account), 0, saslconn);
>
> It didn't return SASL_OK. Maybe it returned SASL_NOMECH instead.

Very nice pointer to help debugging the problem:

> - does "ldd /usr/bin/mutt" show it pointing to the right sasl lib?

I already had checked that:

% ldd /usr/bin/mutt | grep sasl
libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007f5174d9e000)

Seemed ok.

> - based on tracing with "ltrace -o /tmp/log mutt", what does
> sasl_client_new actually return?

So this gave me the right track:

,----
| <... sasl_client_init resumed> ) = 0
| getsockname(3, 0x7fff0752dd20, 0x7fff0752de4c, 0, 64) = 0
| getnameinfo(0x7fff0752dd20, 16, "\305\336eO", 1025, "\001", 32, 3) = 0
| snprintf("\001\200\255\373\001", 4964065, "") = 16
| getpeername(3, 0x7fff0752dda0, 0x7fff0752de4c, 0x4bbee1, 0) = 0
| getnameinfo(0x7fff0752dda0, 16, "10.0.0.188", 1025, "", 32, 3) = 0
| snprintf("\001\200\255\373\001", 4964065, "") = 18
| sasl_client_new(0x4b7457, 0x25db690, 0x7fff0752d520, 0x7fff0752d920,
| 0x6dbe20) = 0xffffffff
`----

Although getnameinfo() seems to successfully return with 0. I tried

% hostname
intrepid

and
% hostname -f
hostname: Name or service not known

I then quickly added something like:

127.0.1.1 intrepid.lan intrepid

in my '/etc/hosts' file and tried again:

% hostname -f
intrepid.lan

Then I restarted mutt and was able to read my mails. *yeah* ;)


Just a quick note on my setup here: My machine is in a simple
home-network using a Thomson TG585 v7 as my router and DHCP-Server.

So a few things I am curious about (maybe a bit OT):

- why did fqdn-lookup fail on my setup? (read: what did I do wrong
when installing my system?)
- why does mutt fail so miserably without a fqdn? (read: shouldn't
it give me a better error message?)
- is my workaround ok? (This is a home-network. I can not and do not
want to setup a DNS-Server and also do not want set static IPs).

So thank you very much Jonathan!

But: I am still not sure if this is a bug in the code, the
documentation or a misleading error message. What do you think?

Regards,
- Darsha

[Antonio Radici]

Control: tag -1 moreinfo

Hi,
I was wondering if you can still reproduce this bug against 1.7.0-1

[Antonio Radici]

Control: tag -1 +unreproducible

Closing this bug as no info was provided and we also believe that it is not
reproducible in 1.7.0-1