2.3.14: posting to shared mailbox results in 550 Permission denied

[Bron Gondwana]

On Fri, May 29, 2009 at 04:51:58PM +0200, Simon Matter wrote:
> In auth_unix.c/mymemberof() I have added the following line at the
> beginning of the function:
> 
> syslog(LOG_ERR, "mymemberof() userid: %s, identifier: %s",
> auth_state->userid, identifier);

Yikes.  Seriously?  auth_state->userid huh?

> Now I see the following difference:
> 
> 2.3.13:
> May 29 16:47:42 client140 lmtp[16435]: mymemberof() userid: (null),
> identifier: anyone
> May 29 16:47:42 client140 lmtp[16435]: mymemberof() userid: (null),
> identifier: anonymous
> 
> 2.3.14:
> May 29 16:44:42 client140 lmtp[16145]: mymemberof() userid: , identifier:
> anyone
> May 29 16:44:42 client140 lmtp[16145]: mymemberof() userid: , identifier:
> anonymous
> 
> I think what you said should be NULL can be seen here in 2.3.13 but not in
> 2.3.14. What do you think?

I think it's surprising that you don't get a segfault dereferencing a
NULL pointer for auth_state in the first place, in either of them.
But it's even more odd that you're seeing differences with userid.
It being "" (a pointer to a zero byte) is pretty bad.

I'd better go back re-read the code.

By the way, on my testbed running current 2.3.14 based code:

RCPT TO:<+shared.foo>
250 2.1.5 ok

# cyr slott02 dbtool show shared.foo
shared.foo      0 default anyone        lrs     anonymous       p

This is 32 bit.

When I debug it, I get a NULL pointer for auth_state at verify_user.

Bron.