M6.5 [P2]: tls_mode_from_db silently falls back to ImplicitTls on the normal read path #271

New Issue

2026-07-31T17:01:45Z

KofTwentyTwo commented

2026-07-31 17:01:45 +00:00

(Migrated from github.com)

Flagged during #248 (salvage TLS fix). db.rs's tls_mode_from_db (used by normal account reads: list_accounts/get_account etc.) has the SAME silent-fallback-to-ImplicitTls shape that #248 just fixed in the salvage path — an unrecognized stored TLS-mode string silently becomes ImplicitTls with no signal, on the path that runs constantly (not just recovery). TLS modes are validated on write (#194/#200) so this should only happen on corruption/tampering, but a silent downgrade still hides it. Goal: make it consistent with the salvage fix — preserve the real mode; on a genuinely unrecognized value, WARN-log (account id + column + raw value) rather than silently defaulting. Source: #248 follow-up.

Flagged during #248 (salvage TLS fix). `db.rs`'s `tls_mode_from_db` (used by normal account reads: list_accounts/get_account etc.) has the SAME silent-fallback-to-ImplicitTls shape that #248 just fixed in the salvage path — an unrecognized stored TLS-mode string silently becomes ImplicitTls with no signal, on the path that runs constantly (not just recovery). TLS modes are validated on write (#194/#200) so this should only happen on corruption/tampering, but a silent downgrade still hides it. Goal: make it consistent with the salvage fix — preserve the real mode; on a genuinely unrecognized value, WARN-log (account id + column + raw value) rather than silently defaulting. Source: #248 follow-up.

KofTwentyTwo commented

2026-08-15 01:33:30 +00:00

(Migrated from github.com)

Fixed in #425 (ce49515), merged to dev. tls_mode_from_db now fails closed with DatabaseError::Corrupted naming the account, the column and the raw value, instead of silently coercing an unrecognised stored mode to ImplicitTls. One function served both imap_tls_mode and smtp_tls_mode, so both are covered and the test exercises each column. list_accounts already returned Result, so no signature or caller changed and nothing panics.

The salvage path in recovery.rs is deliberately left lenient — it has no caller to return an error to — and that asymmetry is documented in code.

Follow-up filed as #426: the same silent-fallback shape sits a few lines away, coercing an unparseable stored protocol discriminator to ImapSmtp, which then reads the wrong columns for that row.

Fixed in #425 (`ce49515`), merged to `dev`. `tls_mode_from_db` now fails closed with `DatabaseError::Corrupted` naming the account, the column and the raw value, instead of silently coercing an unrecognised stored mode to `ImplicitTls`. One function served both `imap_tls_mode` and `smtp_tls_mode`, so both are covered and the test exercises each column. `list_accounts` already returned `Result`, so no signature or caller changed and nothing panics. The salvage path in `recovery.rs` is deliberately left lenient — it has no caller to return an error to — and that asymmetry is documented in code. Follow-up filed as #426: the same silent-fallback shape sits a few lines away, coercing an unparseable stored `protocol` discriminator to `ImapSmtp`, which then reads the wrong columns for that row.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#271