Re: Mail.app DoS

[Brian Elliott Finley <finley@anl.gov>]

We have experienced this.  When it happens, we put the account into
maintenance mode for a minute, then take it back out.

We are considering creating a swatch rule that triggers putting the
account into maintenance mode.  If you can catch it early enough, the
load doesn't get a chance to rise, and it can be handled quickly and
silently (from the perspective of the user, and all the other users).

We've also seen this happen with one particular publication
subscription.  When emails arrive from this particular publication, and
a user clicks on the message using an IMAP client (Thunderbird or
Mail.app), we get the same result.  We call it an "IMAP Frenzy".

-Brian


On 05/05/2010 12:17 PM, David N. Blank-Edelman wrote:
> Hi-
>   Given the preponderance of macs in edu, I'm curious if other sites have seen this particular phenomena. I'm about to burn a support ticket on this because it is getting a bit troublesome.
> 
> We're seeing an unpleasant situation where by if a Mail.app user deletes a bunch of messages and then empties their trash folder, sometimes Mail.app gets into this tight loop with out Zimbra 5.x server. Mail.app at that point starts to send commands at a rate of N per second when N is a surprisingly large number. Zimbra, in turn, logs tens of thousands of lines that look like this:
> 
>> 2010-05-04 11:41:35,306 INFO [ImapSSLServer-634329] [name=user@zimbra;mid=419;ip=ip;] imap - S: 291726.299 BAD parse error: invalid message sequence number: 1:*
>> 2010-05-04 11:41:35,362 INFO [ImapSSLServer-634329] [name=user@zimbra;mid=419;ip=ip;] imap - S: 291727.299 BAD parse error: invalid message sequence number: 1:*
>> 2010-05-04 11:41:35,432 INFO [ImapSSLServer-634329] [name=user@zimbra;mid=419;ip=ip;] imap - S: 291729.299 BAD parse error: invalid message sequence number: 2:*
> 
> while this is going on. As you'd expect, this drives the load up on the server significantly and only abates when the bad connection goes away. I haven't yet stuck a sniffer on the line to catch the precise command it is sending. If mail.app is restarted or the connection forcefully broken, the mail client becomes sane again.
> 
> I haven't found much in the forums (we added a message to this active thread http://www.zimbra.com/forums/administrators/32576-mailbox-log-full-invalid-message-sequence-number-errors.html#post182064).
> 
> So, anyone else having this fun, and were you able to do anything about it?
> 
>        -- dNb

-- 
Brian Elliott Finley
Manager, Application Platforms - Infrastructure and Operations
Computing and Information Systems,  Argonne National Laboratory
Office: +1 630.252.4742  Mobile: +1 630.447.9108