1759197 - ClientID security setting for SMTP no longer works after recent release 91.5

Status: RESOLVED FIXED

(MailNews Core :: Networking: SMTP, defect)

Description

[DevTeam]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:97.0) Gecko/20100101 Firefox/97.0

Steps to reproduce:

I had previously configured ClientID settings for my account in Thunderbird via Preferences / Config Editor - setting values:

• mail.server.default.clientid -> (auto generated UUID string value)
• mail.server.default.clientidEnabled -> true
• mail.server.server1.clientid -> (auto generated UUID string value)
• mail.smtpserver.default.clientid -> (auto generated UUID string value)
• mail.smtpserver.default.clientidEnabled -> true
• mail.smtpserver.smtp1.clientid -> (auto generated UUID string value)

This previously ensured that using Thunderbird to check email (via IMAP) and send email (via SMTP) would send a CLIENTID value after SSL negotiation, but before authentication.

Actual results:

After a recent software update of the thunderbird software on Ubuntu 20.04 - version 91.5 - the IMAP connections would still issue a CLIENTID value at the expected location, but would no longer issue a CLIENTID value for SMTP.

Expected results:

I expected that SMTP would have issued the configured ClientID command/value after successful SSL negotiation (but before authentication).

Comment 1

[Ping Chen [:rnons] (away)]

Thanks for reporting, didn't know about this feature, seems introduced in bug 1532388, will take a look.

Comment 2

[DevTeam]

If needed, I can provide a testing mailbox on a server that is ClientID enabled.

Comment 3

[DevTeam]

Found that in release 91.5 (current version packaged in Ubuntu 20.04) that using the advanced 'Config Editor' - turning off the option 'mailnews.smtp.jsmodule' restored ClientID for SMTP.

However, looking at the current source check out from Mercurial, it looks like what I presume was planned to be phased out C++ nsSmtpProtocol.cpp/h files are completely removed - and no indication that the ClientID logic was ported to the JSM version - I believe that would be SmtpClient.jsm?

Comment 4

[Ping Chen [:rnons] (away)]

That's correct, nsSmtpProtocol.cpp has been removed from trunk, fix should go to SmtpClient.jsm. Let me know if you want to send a patch, otherwise I will work on it later this week. Thanks.

Comment 5

[DevTeam]

I will give it a try tomorrow - but my JS -FU is not nearly as strong as my C/C++ Fu - I'll report back either way tomorrow on my success or failure :)

Comment 6

[DevTeam]

Attachment: smtp-clientid-jsm.patch

This patch attempts to port the ClientID capability introduced in https://bugzilla.mozilla.org/show_bug.cgi?id=1532388 for SMTP to the new SmtpClient.jsm implementation that appears to have taken over that functionality previously handled in nsSmtpProtocol.cpp.

While this is definitely not a 1 to 1 match for the original patch, I have tried to retain the integrity of the functionality it was trying to achieve to the best of my ability.

Comment 7

[DevTeam]

I've posted my best effort port of the functionality as a patch.

Something I am not sure how to do - is create a test - to ensure that this works properly and conforms with the packaging architecture of thunderbird in general.

Comment 8

[Ping Chen [:rnons] (away)]

Attachment: Bug 1759197 - Support clientid extension in SmtpClient.jsm. r=mkmelin

Based on patch from [e-mail].

Comment 9

[Ping Chen [:rnons] (away)]

Thanks a lot, I made some changes to your patch, please see if they make sense. It seems not easy to add a test, we have a smtpd.jsm, which is a test server and no ssl support.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/1ff2b6c889b1
Support clientid extension in SmtpClient.jsm. r=mkmelin

Comment 11

[DevTeam]

Modifications look good / make sense - thanks! And thanks for adding a test!

Comment 12

[Wayne Mery (:wsmwk)]

Comment on attachment 9268186 [details]
Bug 1759197 - Support clientid extension in SmtpClient.jsm. r=mkmelin

[Triage Comment]
Approved for beta

Comment 13

[Rob Lemley [:rjl]]

Thunderbird 99.0b2:
https://hg.mozilla.org/releases/comm-beta/rev/b2ec8be8d272

Comment 14

[Ping Chen [:rnons] (away)]

Comment on attachment 9268186 [details]
Bug 1759197 - Support clientid extension in SmtpClient.jsm. r=mkmelin

[Approval Request Comment]
Regression caused by (bug #): bug 1661694
User impact if declined: Client identity extension doesn't work for SMTP.
Testing completed (on c-c, etc.): beta
Risk to taking this patch (and alternatives if risky): low

Comment 15

[Ping Chen [:rnons] (away)]

Comment on attachment 9268186 [details]
Bug 1759197 - Support clientid extension in SmtpClient.jsm. r=mkmelin

[Approval Request Comment]
Based on the -esr91 patch in bug 1733366. Thanks

Comment 16

[Wayne Mery (:wsmwk)]

Comment on attachment 9268186 [details]
Bug 1759197 - Support clientid extension in SmtpClient.jsm. r=mkmelin

[Triage Comment]
Approved for ers91

Comment 17

[Rob Lemley [:rjl]]

Thunderbird 91.8.1:
https://hg.mozilla.org/releases/comm-esr91/rev/a170398c4744