537388 - Cannot receive mail from one particular IMAP server (Evolution has no problems)

Status: RESOLVED WORKSFORME

(Thunderbird :: General, defect)

Description

[Martin Burchell]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1.6) Gecko/20091216 Fedora/3.5.6-1.fc11 Firefox/3.5.6
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1.5) Gecko/20091204 Thunderbird/3.0

Since moving to Thunderbird 3.0, I've been unable to receive mail on one particular IMAP account. I can send OK, except that a copy of my message can't be stored in the Sent folder.  Evolution has no problems receiving mail from the same account. GMail is working fine from Thunderbird for both sending and receiving on IMAP.

This is a problem in both 3.0 and the latest nightly builds of 3.1 and 3.2


Reproducible: Always

Steps to Reproduce:
1. Remove .thunderbird directory
2. Start Thunderbird
3. Enter email address etc and allow Thunderbird to set up account
 
Actual Results:  
Message window appears. Not prompted for password. Clicking on "Get Mail" does nothing. No folders visible except for the default Inbox etc.


Expected Results:  
Message window appears. Prompted to enter password for account. Folders downloaded into Message Window.

I'll attach a log file from the failed attempt with these settings

$ export NSPR_LOG_MODULES=IMAP:5
$ export NSPR_LOG_FILE=/tmp/thunderbird-imap-log.txt

Comment 1

[Martin Burchell]

Attachment: IMAP log from failed attempts to get messages

This is the IMAP log file from creating the email account from scratch, accepting the defaults from Thunderbird. Then I clicked on "Get Mail". Then I tried to change connection security from STARTTLS to SSL/TLS and ticked secure authentication and clicked on "Get Mail" again.

Comment 2

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #1)

> tried to change connection security from STARTTLS to SSL/TLS(snip)

Server doesn't seem support SSL/TLS. Server returns STARTTLS to CAPABILITY but it looks that server is not well configured for STARTTLS.
Tb2 had "TLS, if avail"(meaning is "STARTTLS, if avail"), and falls back to no STARTTLS use if no STARTTLS response or failure of STARTTLS. But Tb3 doesn't fall back if STARTTLS is requested by user for security reason.
Try connection security: None.

Comment 3

[Martin Burchell]

Attachment: IMAP log with security set to "none"

This is the IMAP log file from when I set the security to "None".

Comment 4

[Martin Burchell]

 (In reply to comment #2)
> Server doesn't seem support SSL/TLS. 

That's interesting because Evolution seems OK with SSL encryption.  Whether it  has a fallback option I don't know.

> Server returns STARTTLS to CAPABILITY but
> it looks that server is not well configured for STARTTLS.
> Tb2 had "TLS, if avail"(meaning is "STARTTLS, if avail"), and falls back to no
> STARTTLS use if no STARTTLS response or failure of STARTTLS. But Tb3 doesn't
> fall back if STARTTLS is requested by user for security reason.
> Try connection security: None.

Thanks for that suggestion.  See the attachment above. I also get a dialogue with the message "You cannot log in to mail.somewhere.xxx because the server doesn't allow plaintext authentication without STARTTLS or SSL/TLS. Try enabling connection security or secure authentication in the account settings."

Comment 5

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #4)
> I also get a dialogue (snip)
> "... because the server doesn't allow plaintext authentication without STARTTLS or SSL/TLS.
> Try enabling connection security or secure authentication in the account settings."

Capability response.
> * CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=REFERENCES MULTIAPPEND UNSELECT
>   LITERAL+ IDLE CHILDREN NAMESPACE LOGIN-REFERRALS STARTTLS LOGINDISABLED

It looks that your server doesn't force STARTTLS use or SSL/TLS use, because message such as "STARTTLS is required" is not returned when Connection Security:None. It seems that your server requests SASL-IR mechanism if STARTTLS nor SSL/TLS is not used.
Log looks like next;
 - Your server returns STARTTLS, but doesn't force STARTTLS use.
 - Your server returns SASL-IR but no AUTH.
 - Your setting is Connection Security:None(STARTTLS nor SSL/TLS is not used)
 - "Secure authentication" is not checked(SASL-IR is ignored)
 - Then, plain text logon with plan text password is attempted by Tb,
   and server silently killed connection,
   thus the message was issued by Tb.
> See http://tools.ietf.org/html/rfc4959 for SASL-IR
Try next, please.
  - Connection Security:None
  - "Use secure authentication" is Checked

Comment 6

[Martin Burchell]

(In reply to comment #5)
> Try next, please.
>   - Connection Security:None
>   - "Use secure authentication" is Checked

I get the message "You cannot log in to mail.somewhere.xxx because you have enabled secure authentication and this server does not support it. To log in, turn
off secure authentication for this account."

I'll attach the log as before.

Comment 7

[Martin Burchell]

Attachment: IMAP log with security set to "none" and secure authentication enabled

Comment 8

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #7)
> IMAP log with security set to "none" and secure authentication enabled

> * OK Dovecot ready.
> 1 capability
> * CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=REFERENCES MULTIAPPEND UNSELECT LITERAL+ IDLE CHILDREN NAMESPACE LOGIN-REFERRALS STARTTLS LOGINDISABLED
> 1 OK Capability completed.
> mail.somewhere.xxx:NA:ProcessCurrentURL: aborting queued urls

Tb stops to attempt login(authenticasion) because no AUTH response?.
Server requests STARTTLS with SSL2? (it worked with Tb2...) 

Can you check next?
> Connection Security: STARTTLS
> "Use secure authentication" is Unchecked
> At config editor,
>   security.enable_ssl2 : false => true
>   security.ssl2.xxx : if false, change it to true
If still fails, try next in addition to above, please. 
>   security.ssl3.xxx : if false, change it to true
If still fails, try next in addition to all of above, please. 
>   security.enable_ssl3 : change from true to false

Comment 9

[Martin Burchell]

(In reply to comment #8)
> Can you check next?
> > Connection Security: STARTTLS
> > "Use secure authentication" is Unchecked
> > At config editor,
> >   security.enable_ssl2 : false => true
> >   security.ssl2.xxx : if false, change it to true
> If still fails, try next in addition to above, please. 
> >   security.ssl3.xxx : if false, change it to true
> If still fails, try next in addition to all of above, please. 
> >   security.enable_ssl3 : change from true to false

Still no joy, unfortunately. I'll attach one annotated log file for the three steps.

Comment 10

[Martin Burchell]

Attachment: IMAP log with STARTTLS, no secure authentication and various config editor changes

Comment 11

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #10)
> IMAP log with STARTTLS, no secure authentication and various config editor changes

Log says;
> 1 OK Capability completed.
> 2 STARTTLS
> 2 OK Begin TLS negotiation now.
> 3 capability
> CreateNewLineFromSocket: clearing IMAP_CONNECTION_IS_OPEN - rv = 805a1ff4
> TellThreadToDie: close socket connection
> CreateNewLineFromSocket: (null)
> ProcessCurrentURL: aborting queued urls

After "2 OK Begin TLS negotiation now.", STARTTLS related logs usualy follow, but Tb issues next "3 capability" even though no such logs.
It looks that something wrong occurs during TLS negotiation, but Tb can't detect it and issues next "3 capability", then error at socket level happens.

CC-ing to Nelson Bolyard(:MisterSSL). How can we get data for diagnosis?
(A Happy New Year, Nelson)

Comment 12

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #0)
> Since moving to Thunderbird 3.0, (snip)

To Martin Burchell(bug opener):

How did you upgrad to Tb3 from Tb2? If upgrade by "Software update of Tb2", try clean install of Tb3(install Tb3 to null directory). Does your problem still occur?

Check with new profile after "clean install". Does your problem still occur?

Comment 13

[Martin Burchell]

(In reply to comment #12)
> To Martin Burchell(bug opener):
> 
> How did you upgrad to Tb3 from Tb2? If upgrade by "Software update of Tb2", try
> clean install of Tb3(install Tb3 to null directory). Does your problem still
> occur?
> 
> Check with new profile after "clean install". Does your problem still occur?

Thanks for checking.  Originally I upgraded from Tb2 to Tb3 as a result of upgrading from Fedora 10 to Fedora 11.  However, for these tests I've been running from a clean install of Tb3 in a temporary directory and deleting my .thunderbird directory every time.

Comment 14

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #13)
> Originally I upgraded from Tb2 to Tb3 as a result of upgrading from Fedora 10 to Fedora 11.

What Tb3 build did you installed on your new Fedora 11?
> http://www.phoronix.com/scan.php?page=news_item&px=NzEwNQ ponits next
> http://fedoraproject.org/wiki/Features/Thunderbird_3#Scope says;
>   Scope
>   Rebuild Thunderbird.
Do you use Tb3 package for Fedora 11 provided by Fedora Project?
Tb3 for Fedora 11 is packaged in Fedora 11 package?

Comment 15

[Martin Burchell]

Yes originally I saw this problem with whatever the default Fedora 11 package is provided by the Fedora Project, which is currently thunderbird-3.0-3.fc11.i586

But in my tests for this bug report I'm using the version of Tb3 downloaded from http://download.mozilla.org/?product=thunderbird-3.0&os=linux&lang=en-GB

and also the nightly builds of 3.1 and 3.2 as of 2009-12-31

Comment 16

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #15)
> I'm using the version of Tb3 downloaded from http://download.mozilla.org/?product=thunderbird-3.0&os=linux&lang=en-GB

Can you check with en-US build?
I saw some bugs relate to login to server(SMTP?) due to(or relevant to) over localization or incorrect localization.

Comment 17

[Martin Burchell]

I see the same problem with the en-US build

Comment 18

[Martin Burchell]

Thunderbird 3 has now been working with this mail server ever since 2010-02-02. According to the logs, these are the only relevant changes that might have caused this:

* dovecot SSL parameters were regenerated on the 2010-01-27 at 19:08.
* HELO checks were enabled and exim was restarted on the 2010-01-28 at 13:16.
* nscd was restarted on 2010-01-31 at 13:32 and crashed at 18:35.
* The procmail lmtp transport was reconfigured and exim was restarted and 
telnet was installed on the 2010-02-01 at 08:33.