Message contains NUL characters ...

[John Fawcett]

Greg A. Woods wrote:

> I don't know why you guys keep beating against this.  There's nothing
> wrong with Cyrus and nothing that needs changing in Cyrus.

the reason is that at the moment I can have nuls rejected by cyrus
and potentially bounced to some innocent third party in the case
of forged sender addresses.

My reading of the earlier posts was that nuls were acceptable but
had to be stripped, even by cyrus.

> 
> NUL bytes do not belong in e-mail (and never have).
> 
> NUL bytes are simply not allowed in IMAP.
> 
> There's no valid reason for allowing NUL bytes in SMTP (or LMTP), just
> very poor and effectively invalid excuses.

If that is the case then fixes are required for MTAs. My whole point
is that I don't care about whether I can receive messages with nuls,
I just don't want to reject them in cyrus because that creates
bounces to innocent parties. So either cyrus should strip the nuls
or the MTAs should reject the messages during the initial SMTP session.

> Just because some deprecated part of some ancient RFC seems to include
> NUL in the list of permitted characters doesn't mean NULs must be
> allowed -- clearly the intent was otherwise, else SMTP would have been
> defined to be completely 8-bit transparent right from the beginning.  In
> reality SMTP was defined to be just and only the lowest common
> denominator, and NULs obviously cannot be part of such a definition.
> 
> Allowing NUL bytes through transparently leaves one responsible for
> potential security problems that they might create for a mail reader.

no-one wants this

> Stripping NUL bytes modifies the message and that's a _REALLY BAD_ thing
> to do.  It is infinitely better to reject than to arbitrarily modify the
> message in a destructive manner.

Maybe I misunderstood earlier posts which indicated this was ok.
If cyrus is correct to reject then we really need mta patches
(maybe apart from sendmail where I understand the rejection is
configurable).

> Doing either of these things in Cyrus instead of the MTA is insane.
> 
> Cyrus is already doing the right thing.  Please leave it as-is!
> 
> If you can't re-configure or fix your MTA to reject messages that
> contain NUL bytes (in either the headers or body -- it's all the same to
> SMTP), then get a better mailer!!!!
I am very happy with postfix!
> 
> (and if you really do want to accept SMTP data that contains NUL bytes
> then configure or fix your MTA to re-encode the message using MIME or
> quoted-printable header encoding as appropriate for the location of the
> offending NUL -- but don't try to do this in Cyrus as it's the wrong
> place for such transformations to be attempted!!!)
> 
no I don't want to accept them, I just don't want to create useless
bounces.

John
---
Cyrus Home Page: http://asg.web.cmu.edu/cyrus
Cyrus Wiki/FAQ: http://cyruswiki.andrew.cmu.edu
List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html