Package: mutt
Version: 2.2.3-2
Severity: normal

Dear Maintainer,
after Mutt upgrade from version 2.1.4-1 to version 2.2.3-2 SASL
authentication stopped working.

Debug from Mutt version 2.2.3:

 [2022-05-06 10:33:19] Mutt/2.2.3 (2022-04-12) debugging at level 7
 …
 [2022-05-06 10:33:37] Looking up smtp.seznam.cz...
 [2022-05-06 10:33:37] Connecting to smtp.seznam.cz...
 [2022-05-06 10:33:37] Connected to smtp.seznam.cz:587 on fd=5
 [2022-05-06 10:33:38] 5< 220 2.0.0 Seznam SMTP server waiting for your HELO/EHLO
 [2022-05-06 10:33:38] 5> EHLO bobekpc.i.cz^M
 [2022-05-06 10:33:38] 5< 250-Email.Seznam.cz - Email zdarma na cely zivot ESMTP
 [2022-05-06 10:33:38] 5< 250-AUTH LOGIN PLAIN
 [2022-05-06 10:33:38] 5< 250-8BITMIME
 [2022-05-06 10:33:38] 5< 250-PIPELINING
 [2022-05-06 10:33:38] 5< 250-SIZE 52428800
 [2022-05-06 10:33:38] 5< 250-ENHANCEDSTATUSCODES
 [2022-05-06 10:33:38] 5< 250-STARTTLS
 [2022-05-06 10:33:38] 5< 250 X-SZNEXTENSIONS
 [2022-05-06 10:33:38] 5> STARTTLS^M
 [2022-05-06 10:33:38] 5< 220 Ready to start TLS
 [2022-05-06 10:33:38] SSL/TLS connection using TLS1.3 (ECDHE-RSA/AES-256-GCM/AEAD)
 [2022-05-06 10:33:39] 5> EHLO bobekpc.i.cz^M
 [2022-05-06 10:33:39] 5< 250-Email.Seznam.cz - Email zdarma na cely zivot ESMTP
 [2022-05-06 10:33:39] 5< 250-AUTH LOGIN PLAIN
 [2022-05-06 10:33:39] 5< 250-8BITMIME
 [2022-05-06 10:33:39] 5< 250-PIPELINING
 [2022-05-06 10:33:39] 5< 250-SIZE 52428800
 [2022-05-06 10:33:39] 5< 250-ENHANCEDSTATUSCODES
 [2022-05-06 10:33:39] 5< 250 X-SZNEXTENSIONS
 [2022-05-06 10:33:39] smtp_auth_gsasl: using mech PLAIN
 [2022-05-06 10:33:39] Authenticating (PLAIN)...
 [2022-05-06 10:33:39] 5> AUTH PLAIN^M
 [2022-05-06 10:33:39] 5< 334 Send base64(login\0login\0password)
 [2022-05-06 10:33:39] gsasl_step64() failed (8): Base 64 coding error in SASL library
 [2022-05-06 10:33:39] 5> *^M
 [2022-05-06 10:33:39] smtp_auth_gsasl: PLAIN failed
 [2022-05-06 10:33:39] SASL authentication failed


Debug from Mutt version 2.1.4:

 [2022-05-06 10:58:03] Mutt/2.1.4 (2021-12-11) debugging at level 7
 …
 [2022-05-06 10:58:16] Looking up smtp.seznam.cz...
 [2022-05-06 10:58:16] Connecting to smtp.seznam.cz...
 [2022-05-06 10:58:16] Connected to smtp.seznam.cz:587 on fd=5
 [2022-05-06 10:58:17] 5< 220 2.0.0 Seznam SMTP server waiting for your HELO/EHLO
 [2022-05-06 10:58:17] 5> EHLO bobekpc.i.cz^M
 [2022-05-06 10:58:17] 5< 250-Email.Seznam.cz - Email zdarma na cely zivot ESMTP
 [2022-05-06 10:58:17] 5< 250-AUTH LOGIN PLAIN
 [2022-05-06 10:58:17] 5< 250-8BITMIME
 [2022-05-06 10:58:17] 5< 250-PIPELINING
 [2022-05-06 10:58:17] 5< 250-SIZE 52428800
 [2022-05-06 10:58:17] 5< 250-ENHANCEDSTATUSCODES
 [2022-05-06 10:58:17] 5< 250-STARTTLS
 [2022-05-06 10:58:17] 5< 250 X-SZNEXTENSIONS
 [2022-05-06 10:58:17] 5> STARTTLS^M
 [2022-05-06 10:58:17] 5< 220 Ready to start TLS
 [2022-05-06 10:58:17] SSL/TLS connection using TLS1.3 (ECDHE-RSA/AES-256-GCM/AEAD)
 [2022-05-06 10:58:18] 5> EHLO bobekpc.i.cz^M
 [2022-05-06 10:58:18] 5< 250-Email.Seznam.cz - Email zdarma na cely zivot ESMTP
 [2022-05-06 10:58:18] 5< 250-AUTH LOGIN PLAIN
 [2022-05-06 10:58:18] 5< 250-8BITMIME
 [2022-05-06 10:58:18] 5< 250-PIPELINING
 [2022-05-06 10:58:18] 5< 250-SIZE 52428800
 [2022-05-06 10:58:18] 5< 250-ENHANCEDSTATUSCODES
 [2022-05-06 10:58:18] 5< 250 X-SZNEXTENSIONS
 [2022-05-06 10:58:18] SASL local ip: 10.2.36.5;43614, remote ip:77.75.78.48;587
 [2022-05-06 10:58:18] External SSF: 256
 [2022-05-06 10:58:18] External authentication name: my-login-name
 [2022-05-06 10:58:18] mutt_sasl_cb_authname: getting authname for smtp.seznam.cz:587
 [2022-05-06 10:58:18] mutt_sasl_cb_authname: getting user for smtp.seznam.cz:587
 [2022-05-06 10:58:18] mutt_sasl_cb_pass: getting password for my-login-name@smtp.seznam.cz:587
 [2022-05-06 10:58:18] Authenticating (PLAIN)...
 [2022-05-06 10:58:18] 5> AUTH PLAIN <<<base64-encoded-data-removed>>>^M
 [2022-05-06 10:58:18] 5< 235 2.2.0 Authentication succeeded
 [2022-05-06 10:58:18] SASL protection strength: 0
 [2022-05-06 10:58:18] SASL protection buffer size: 65536

Thanks for maintaining Mutt
Regards

According to my understanding of RFC4954, the "server challenge" 334
response must either be blank (i.e., "334 "), or if there is data it
must be base64 encoded.

The Cyrus SASL library also assumes all data from the server will be
base64 encoded, but it is smarter and knows it can send an initial
response with AUTH PLAIN.

What happens if you set smtp_authenticators=login?  Does the server also
send plain text in the 334 response?

I'm still interested to hear if 'set smtp_authenticators=login' works
for you, just to make sure there isn't another issue I need to be aware
of.

However, in the mean time I've pushed a commit up to branch
'kevin/gsasl-smtp-plain-workarounds' on gitlab:
<https://gitlab.com/muttmua/mutt/-/commit/85379c5a01168154f74a7d9841d1eab152b1b6b0.patch>

Would you be willing to try that patch - either via compiling from git,
or modifying the deb package and adding the patch to it?

thank you,

I've merged this branch into stable, and it will be a part of 2.2.5
sometime in the next few weeks.

Antonio if this starts to cause problems for others and 2.2.5 isn't out
yet, feel free to grab the patch and apply to 2.2.4-2:

https://gitlab.com/muttmua/mutt/-/commit/9d5db7cb7e53be20bb3b87dd5877e7145660b931.patch

Sorry, I was not subscribed to the bugreport… :-(

I have added

 set smtp_authenticators=login

and things works now!

 [2022-05-12 16:47:53] 5< 250-PIPELINING
 [2022-05-12 16:47:53] 5< 250-SIZE 52428800
 [2022-05-12 16:47:53] 5< 250-ENHANCEDSTATUSCODES
 [2022-05-12 16:47:53] 5< 250 X-SZNEXTENSIONS
 [2022-05-12 16:47:53] smtp_authenticate: Trying method login
 [2022-05-12 16:47:53] smtp_auth_gsasl: using mech LOGIN
 [2022-05-12 16:47:53] Authenticating (LOGIN)...
 [2022-05-12 16:47:53] 5> AUTH LOGIN
 [2022-05-12 16:47:53] 5< 334 VXNlcm5hbWU6
 [2022-05-12 16:47:53] 5> <<<base64-encoded-username>>>
 [2022-05-12 16:47:53] 5< 334 UGFzc3dvcmQ6
 …

So the problem is with the SMTP server side?
Thank you very much!

Great!  Thank you for checking that LOGIN works properly.  I wanted to
make sure there weren't other problems I needed to address inside Mutt.

Technically it is, but I have made a commit in Mutt to work around the
bug.  It will be in 2.2.5, or earlier if Antonio decides to add the
patch to the Debian package.

Thank you,