I have recently upgraded our mail relays from exim V4.14 to V4.43 and a
problem with long 550 responses seems to be happening.
The problem seems to be in deliver.c when the receiving host sends a
very long 550 response.
I have run a test with the actual response:-
SpamAssassin: 117.8: 4.1 RATWARE_EGROUPS Bulk email fingerprint
(eGroups) found, 1.5 DATE_MISSING Missing Date: header, 1.3
RCVD_NUMERIC_HELO Received: contains a numeric HELO, 0.8
HTML_IMAGE_ONLY_12 BODY: HTML: images with 1000-1200 bytes of words,
0.4 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags, 0.2
HTML_MESSAGE BODY: HTML included in message, 0.1 HTML_FONTCOLOR_UNSAFE
BODY: HTML font color not in safe 6x6x6 palette, 0.7 MIME_HTML_ONLY
BODY: Message only has text/html MIME parts, 0.7 HTML_50_60 BODY:
Message is 50% to 60% HTML, 0.4 HTML_TITLE_EMPTY BODY: HTML title
contains no text, 1.1 MIME_HTML_NO_CHARSET RAW: Message text in HTML
without charset, 0.2 MIME_QP_LONG_LINE RAW: Quoted-printable line
longer than 76 chars, 104 SARE_FORGED_PAYPAL Message appears to be
forged, (paypal.com), 1.3 SARE_FORGED_PAYPAL_C Has Paypal from, no
Paypal received header., 1.1 MIME_HTML_ONLY_MULTI Multipart message
only has text/html MIME parts
And it looks like the problem occurs somewhere between 800 and 900
characters. The effect is that the message only gets queued and when a
queue runner subsequently tries to deliver it we get one of these log
messages:-
2004-12-06 08:27:45 queue run: process 11563 crashed with signal 11
while delivering 1CbAyY-00043j-Lf
2004-12-06 10:27:53 queue run: process 19638 crashed with signal 139
while delivering 1CbFrQ-0003X5-3w
This is the response from the postmaster at the receiving host:-
It's possible Exim doesn't like huge responses to the DATA phase.
Here's my log:
2004-12-05 13:12:59 1CawCA-00018A-6s H=mail1.qmul.ac.uk [138.37.6.7]
F=<services@???> rejected after DATA: SpamAssassin: 117.8: 4.1
RATWARE_EGROUPS Bulk email fingerprint (eGroups) found, 1.5
DATE_MISSING Missing Date: header, 1.3 RCVD_NUMERIC_HELO Received:
contains a numeric HELO, 0.8 HTML_IMAGE_ONLY_12 BODY: HTML: images with
1000-1200 bytes of words, 0.4 HTML_TAG_BALANCE_BODY BODY: HTML has
unbalanced "body" tags, 0.2 HTML_MESSAGE BODY: HTML included in
message, 0.1 HTML_FONTCOLOR_UNSAFE BODY: HTML font color not in safe
6x6x6 palette, 0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME
parts, 0.7 HTML_50_60 BODY: Message is 50% to 60% HTML, 0.4
HTML_TITLE_EMPTY BODY: HTML title contains no text, 1.1
MIME_HTML_NO_CHARSET RAW: Message text in HTML without charset, 0.2
MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars, 104
SARE_FORGED_PAYPAL Message appears to be forged, (paypal.com), 1.3
SARE_FORGED_PAYPAL_C Has Paypal from, no Paypal received header., 1.1
MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
NB the SMTP response is a little longer! Here's my ACL entry
deny message = Content examination found this message \
to be spam.\nSpam score: $spam_score\n$spam_report
condition = ${if <{$message_size}{180k}{1}{0}}
!authenticated = login:plain
spam = nobody:true
condition = ${if >{$spam_score_int}{90}{1}{0}}
log_message = SpamAssassin: $spam_score: \
${sg{${sg{$spam_report}{\\n}{,}}}{\\s+}{ }}
--
.-----------------------------------------------------------------------
-------------------.
| Steve Sargent, Vox +44 020 7882 3220, Fax +44 020 8980 2001
|
| QMUL Computing Services, Mile End Road, London E1 4NS, UK
|
| Email : S.L.Sargent@???
|
| WWW page: http://www.qmul.ac.uk/~cgaa160/index.html
|
|
|
| PIPER
_|_ |
| PA28R
____/___\___ |
|
___________[=o=]___________ |
| ARROW
e/ o \e |
.-----------------------------------------------------------------------
-------------------.
