Apple Mail 16.0 stuck in IMAP loop generating DDOS like traffic to cyrus imapd
Since some days, we recognize that Apple Mail 16.0 (3774.500.171.1.1) and prior versions access our cyrus IMAP server DDOS like. We have this from different devices from different customers.
The client repeats the following sequence up to 40 times per second for an undefined time, up to hours.
<1711111909<2<1711111909<062.7 SELECT INBOX.Drafts
>1711111909>* FLAGS (\Answered \Flagged \Draft \Deleted \Seen $NotJunk NotJunk $Forwarded $MailFlagBit0 $MailFlagBit1 $MailFlagBit2 Redirected)
* OK [PERMANENTFLAGS (\Answered \Flagged \Draft \Deleted \Seen $NotJunk NotJunk $Forwarded $MailFlagBit0 $MailFlagBit1 $MailFlagBit2 Redirected \*)]
* 1 EXISTS
* 0 RECENT
* OK [UIDVALIDITY 1352217636]
* OK [UIDNEXT 35167]
2062.7 OK [READ-WRITE] Completed
<1711111909<2<1711111909<063.7 FETCH 1 (FLAGS UID)
>1711111909>* 1 FETCH (FLAGS (\Draft \Seen) UID 35166)
2063.7 OK Completed (0.000 sec)
<1711111909<2<1711111909<064.7 IDLE
>1711111909>+ idling
<1711111909<D<1711111909<ONE
>1711111909>2064.7 OK Completed
<1711111910<2<1711111910<065.7 EXPUNGE
>1711111910>* 1 EXISTS
* 0 RECENT
2065.7 OK Completed
<1711111910<2<1711111910<066.7 UNSELECT
>1711111910>2066.7 OK Completed
<1711111910<2<1711111910<067.7 SELECT INBOX.Drafts
>1711111910>* FLAGS (\Answered \Flagged \Draft \Deleted \Seen $NotJunk NotJunk $Forwarded $MailFlagBit0 $MailFlagBit1 $MailFlagBit2 Redirected)
* OK [PERMANENTFLAGS (\Answered \Flagged \Draft \Deleted \Seen $NotJunk NotJunk $Forwarded $MailFlagBit0 $MailFlagBit1 $MailFlagBit2 Redirected \*)]
* 1 EXISTS
* 0 RECENT
* OK [UIDVALIDITY 1352217636]
* OK [UIDNEXT 35167]
2067.7 OK [READ-WRITE] Completed
<1711111910<2<1711111910<068.7 FETCH 1 (FLAGS UID)
>1711111910>* 1 FETCH (FLAGS (\Draft \Seen) UID 35166)
2068.7 OK Completed (0.000 sec)
<1711111910<2<1711111910<069.7 IDLE
>1711111910>+ idling
<1711111910<D<1711111910<ONE
>1711111910>2069.7 OK Completed
<1711111910<2<1711111910<070.7 EXPUNGE
>1711111910>* 1 EXISTS
* 0 RECENT
2070.7 OK Completed
<1711111910<2<1711111910<071.7 UNSELECT
>1711111910>2071.7 OK Completed
On the server, I see, for example:
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Mar 28 09:05:55 mail cyrus/imaps[20712]: open: user support opened INBOX.Drafts
Can anybody confirm that this is a general problem?
I cannot say that anything has been changed to our cyrus imapd or to the customers' Macs that could lead to this problem. It occurred suddenly.
The Problem generates high IO rates on our mail server and storage, so we hope to find a solution for that.
