[exim] TLS problems of late

Kezdőlap
Üzenet törlése
Válasz az üzenetre
Szerző: Warren Baker
Dátum:  
Címzett: exim users
Tárgy: [exim] TLS problems of late
HI All,

Has anyone noticed a problem with exim-4.80.01+OpenSSL 1.0.1e
(installed from FreeBSD ports) and it delivering to remote hosts using
TLS?
Some remote hosts do work. Debugging shows that SSL negotiation
finished successfully but straight after that it is logged that the
remote closed the connection in response to MAIL FROM:<>
Disabling TLS fixes the problem or reverting to OpenSSL 0.9.8q (part
of base in FreeBSD 8.2) fixes the problem.

Anyone have suggestions on the best way to debug this to determine if
its a OpenSSL or a Exim problem ?

Below is an example of one remote host with a non-working and a working version:

14:28:57 95534 Connecting to maile.printspots.com [216.16.225.134]:25
... connected
14:28:58 95534 expanding: $primary_hostname
14:28:58 95534    result: mx1.percol8.co.za
14:28:58 95534 waiting for data on socket
14:28:58 95534 read response data: size=121
14:28:58 95534   SMTP<< 220 at-5000.VFPRINT.NET Microsoft ESMTP MAIL
Service, Version: 6.0.3790.4675 ready at  Fri, 22 Feb 2013 07:28:58
-0500
14:28:58 95534 216.16.225.134 in hosts_avoid_esmtp? no (option unset)
14:28:58 95534   SMTP>> EHLO mx1.percol8.co.za
14:28:58 95534 waiting for data on socket
14:28:58 95534 read response data: size=334
14:28:58 95534   SMTP<< 250-at-5000.VFPRINT.NET Hello [41.79.180.20]
14:28:58 95534          250-TURN
14:28:58 95534          250-SIZE
14:28:58 95534          250-ETRN
14:28:58 95534          250-PIPELINING
14:28:58 95534          250-DSN
14:28:58 95534          250-ENHANCEDSTATUSCODES
14:28:58 95534          250-8bitmime
14:28:58 95534          250-BINARYMIME
14:28:58 95534          250-CHUNKING
14:28:58 95534          250-VRFY
14:28:58 95534          250-TLS
14:28:58 95534          250-STARTTLS
14:28:58 95534          250-X-EXPS GSSAPI NTLM LOGIN
14:28:58 95534          250-X-EXPS=LOGIN
14:28:58 95534          250-AUTH GSSAPI NTLM LOGIN
14:28:58 95534          250-AUTH=LOGIN
14:28:58 95534          250-X-LINK2STATE
14:28:58 95534          250-XEXCH50
14:28:58 95534          250 OK
14:28:58 95534 216.16.225.134 in hosts_avoid_tls? no (option unset)
14:28:58 95534   SMTP>> STARTTLS
14:28:58 95534 waiting for data on socket
14:28:59 95534 read response data: size=29
14:28:59 95534   SMTP<< 220 2.0.0 SMTP server ready
14:28:59 95534 setting SSL CTX options: 0x1000000
14:28:59 95534 Diffie-Hellman initialized from default with 2048-bit prime
14:28:59 95534 Initialized TLS
14:28:59 95534 Calling SSL_connect
14:28:59 95534 SSL info: before/connect initialization
14:28:59 95534 SSL info: before/connect initialization
14:28:59 95534 SSL info: SSLv2/v3 write client hello A
14:28:59 95534 SSL info: SSLv3 read server hello A
14:28:59 95534 SSL info: SSLv3 read server certificate A
14:28:59 95534 SSL info: SSLv3 read server done A
14:28:59 95534 SSL info: SSLv3 write client key exchange A
14:28:59 95534 SSL info: SSLv3 write change cipher spec A
14:28:59 95534 SSL info: SSLv3 write finished A
14:28:59 95534 SSL info: SSLv3 flush data
14:28:59 95534 SSL info: SSLv3 read finished A
14:28:59 95534 SSL info: SSL negotiation finished successfully
14:28:59 95534 SSL info: SSL negotiation finished successfully
14:28:59 95534 SSL_connect succeeded
14:28:59 95534 Cipher: TLSv1:DES-CBC3-SHA:168
14:28:59 95534   SMTP>> EHLO mx1.percol8.co.za
14:28:59 95534 tls_do_write(0x7fffffffca80, 24)
14:28:59 95534 SSL_write(SSL, 0x7fffffffca80, 24)
14:28:59 95534 outbytes=24 error=0
14:28:59 95534 waiting for data on socket
14:28:59 95534 Calling SSL_read(0x801c0e800, 0x7fffffffaa80, 4096)
14:28:59 95534 read response data: size=311
14:28:59 95534   SMTP<< 250-at-5000.VFPRINT.NET Hello [41.79.180.20]
14:28:59 95534          250-TURN
14:28:59 95534          250-SIZE
14:28:59 95534          250-ETRN
14:28:59 95534          250-PIPELINING
14:28:59 95534          250-DSN
14:28:59 95534          250-ENHANCEDSTATUSCODES
14:28:59 95534          250-8bitmime
14:28:59 95534          250-BINARYMIME
14:28:59 95534          250-CHUNKING
14:28:59 95534          250-VRFY
14:28:59 95534          250-X-EXPS GSSAPI NTLM LOGIN
14:28:59 95534          250-X-EXPS=LOGIN
14:28:59 95534          250-AUTH GSSAPI NTLM LOGIN
14:28:59 95534          250-AUTH=LOGIN
14:28:59 95534          250-X-LINK2STATE
14:28:59 95534          250-XEXCH50
14:28:59 95534          250 OK
14:28:59 95534 216.16.225.134 in hosts_avoid_pipelining? yes (matched "*")
14:28:59 95534 not using PIPELINING
14:28:59 95534 216.16.225.134 in hosts_require_auth? no (option unset)
14:28:59 95534 216.16.225.134 in hosts_try_auth? no (option unset)
14:28:59 95534   SMTP>> MAIL FROM:<warren@???> SIZE=16250
14:28:59 95534 tls_do_write(0x7fffffffca80, 59)
14:28:59 95534 SSL_write(SSL, 0x7fffffffca80, 59)
14:28:59 95534 outbytes=59 error=0
14:28:59 95534 waiting for data on socket
14:28:59 95534 Calling SSL_read(0x801c0e800, 0x7fffffffaa80, 4096)
14:29:00 95534 SSL info: SSL negotiation finished successfully
14:29:00 95534 ok=0 send_quit=0 send_rset=1 continue_more=0 yield=1
first_address is not NULL
14:29:00 95534 tls_close(): shutting down SSL
14:29:00 95534 SSL info: SSL negotiation finished successfully
14:29:00 95534 LOG: MAIN
14:29:00 95534   Remote host maile.printspots.com [216.16.225.134]
closed connection in response to MAIL FROM:<warren@???>
SIZE=16250


as opposed to the working version to the same remote host:

Connecting to maile.printspots.com [216.16.225.134]:25 ... connected
waiting for data on socket
read response data: size=121
SMTP<< 220 at-5000.VFPRINT.NET Microsoft ESMTP MAIL Service,
Version: 6.0.3790.4675 ready at Fri, 22 Feb 2013 08:01:14 -0500
216.16.225.134 in hosts_avoid_esmtp? no (option unset)
SMTP>> EHLO mx1.percol8.co.za

waiting for data on socket
read response data: size=334
  SMTP<< 250-at-5000.VFPRINT.NET Hello [41.79.180.20]
         250-TURN
         250-SIZE
         250-ETRN
         250-PIPELINING
         250-DSN
         250-ENHANCEDSTATUSCODES
         250-8bitmime
         250-BINARYMIME
         250-CHUNKING
         250-VRFY
         250-TLS
         250-STARTTLS
         250-X-EXPS GSSAPI NTLM LOGIN
         250-X-EXPS=LOGIN
         250-AUTH GSSAPI NTLM LOGIN
         250-AUTH=LOGIN
         250-X-LINK2STATE
         250-XEXCH50
         250 OK
216.16.225.134 in hosts_avoid_tls? no (option unset)

SMTP>> STARTTLS

waiting for data on socket
read response data: size=29
SMTP<< 220 2.0.0 SMTP server ready
setting SSL CTX options: 0x1000000
Diffie-Hellman initialized from default with 2048-bit prime
Initialized TLS
Calling SSL_connect
SSL info: before/connect initialization
SSL info: before/connect initialization
SSL info: SSLv2/v3 write client hello A
SSL info: SSLv3 read server hello A
SSL info: SSLv3 read server certificate A
SSL info: SSLv3 read server done A
SSL info: SSLv3 write client key exchange A
SSL info: SSLv3 write change cipher spec A
SSL info: SSLv3 write finished A
SSL info: SSLv3 flush data
SSL info: SSLv3 read finished A
SSL info: SSL negotiation finished successfully
SSL info: SSL negotiation finished successfully
SSL_connect succeeded
Cipher: TLSv1:RC4-MD5:128
SMTP>> EHLO mx1.percol8.co.za

tls_do_write(0x7fffffffc8c0, 24)
SSL_write(SSL, 0x7fffffffc8c0, 24)
outbytes=24 error=0
waiting for data on socket
Calling SSL_read(0x801c84000, 0x7fffffffa8c0, 4096)
read response data: size=311
  SMTP<< 250-at-5000.VFPRINT.NET Hello [41.79.180.20]
         250-TURN
         250-SIZE
         250-ETRN
         250-PIPELINING
         250-DSN
         250-ENHANCEDSTATUSCODES
         250-8bitmime
         250-BINARYMIME
         250-CHUNKING
         250-VRFY
         250-X-EXPS GSSAPI NTLM LOGIN
         250-X-EXPS=LOGIN
         250-AUTH GSSAPI NTLM LOGIN
         250-AUTH=LOGIN
         250-X-LINK2STATE
         250-XEXCH50
         250 OK
216.16.225.134 in hosts_avoid_pipelining? yes (matched "*")
not using PIPELINING
216.16.225.134 in hosts_require_auth? no (option unset)
216.16.225.134 in hosts_try_auth? no (option unset)

SMTP>> MAIL FROM:<warren@???> SIZE=16250

tls_do_write(0x7fffffffc8c0, 59)
SSL_write(SSL, 0x7fffffffc8c0, 59)
outbytes=59 error=0
waiting for data on socket
Calling SSL_read(0x801c84000, 0x7fffffffa8c0, 4096)
read response data: size=59
SMTP<< 250 2.1.0 warren@???....Sender OK



thanks


--
.warren