[exim-dev] [Bug 3042] EXim closes connection direct after en…

Top Pagina
Delete this message
Reply to this message
Auteur: Exim Bugzilla
Datum:  
Aan: exim-dev
Onderwerp: [exim-dev] [Bug 3042] EXim closes connection direct after end of DATA (.)
https://bugs.exim.org/show_bug.cgi?id=3042

--- Comment #4 from Lars Timmann <lt@???> ---
We catched one problematic mail.

This mail hangs on our external mail server and is not delivered to our
internal mailserver. Both updated to exim-4.96.2. As it is obviously spam we
could show all data:

# exim -Mvl 1qxQSQ-0000I8-1U
2023-10-30 12:29:22.160 Received from admin@??? H=sophosxgs.domain.tld
[192.168.104.42]:45786 I=[192.168.104.33]:25 P=esmtps L.
X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=4191 M8S=0 RT=0.001s
id=20231030112909.0E44C3A2DFE35454@??? T="Business investment"
2023-10-30 12:29:22.430 H=mail.domain.tld [192.168.9.2]:25: Remote host closed
connection in response to end of data
2023-10-30 12:29:22.644 H=mail.domain.tld [192.168.9.100]:25: Remote host
closed connection in response to end of data
2023-10-30 12:29:22.646 user@??? R=mail_route T=remote_smtp defer (-18)
H=mail.domain.tld [192.168.9.100]:25 I=[192.168.104.33]:61120 DT=0.213s: Remote
host closed connection in response to end of data
2023-10-30 12:30:03.901 H=mail.domain.tld [192.168.9.100]:25: Remote host
closed connection in response to end of data
2023-10-30 12:30:04.201 H=mail.domain.tld [192.168.9.2]:25: Remote host closed
connection in response to end of data
2023-10-30 12:30:04.203 user@??? R=mail_route T=remote_smtp defer (-18)
H=mail.domain.tld [192.168.9.2]:25 I=[192.168.104.33]:53387 DT=0.298s: Remote
host closed connection in response to end of data
...
And so on...

# exim -Mvh 1qxQSQ-0000I8-1U
1qxQSQ-0000I8-1U-H
exim 100 100
<admin@???>
1698665362 0
-received_time_usec .157578
-received_time_complete 1698665362.159479
--helo_name sophosxgs.domain.tld
-host_address [192.168.104.42]:45786
--host_name sophosxgs.domain.tld
-interface_address [192.168.104.33]:25
-received_protocol esmtps
-aclm _linelength_limit 3
998
-body_linecount 10
-max_received_linelength 92
-tls_cipher TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256
-tls_ourcert -----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----\n
-tls_resumption B
-tls_ver TLS1.2
XX
1
user@???

298P Received: from sophosxgs.domain.tld ([192.168.104.42]:45786)
        by MailExt1.domain.tld with esmtps  (TLS1.2) tls
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        (Exim 4.96.2)
        (envelope-from <admin@???>)
        id 1qxQSQ-0000I8-1U
        for user@???;
        Mon, 30 Oct 2023 12:29:22 +0100
325P Received: from mailext.domain.tld ([192.168.104.34]:42831
helo=MailExt2.domain.tld)
        by sophosxgs.domain.tld with esmtps  (TLS1.2) tls
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        (Exim 4.96)
        (envelope-from <admin@???>)
        id 1qxQSG-0001T1-2t
        for user@???;
        Mon, 30 Oct 2023 12:29:12 +0100
320P Received: from hwsrv-1105621.hostwindsdns.com ([192.168.216.93]:44389
helo=genarec.com)
        by MailExt2.MH-Hannover.DE with esmtps  (TLS1.2) tls
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        (Exim 4.96.2)
        (envelope-from <admin@???>)
        id 1qxQSG-0006Vl-37
        for user@???;
        Mon, 30 Oct 2023 12:29:12 +0100
038R Reply-To: alamoudimohammad5@???
065F From: Password Notification <anxjf<info@???>
033T To: user@???
029  Subject: Business investment
033  Date: 30 Oct 2023 11:29:10 +0000
058I Message-ID: <20231030112909.0E44C3A2DFE35454@???>
018  MIME-Version: 1.0
024  Content-Type: text/html
044  Content-Transfer-Encoding: quoted-printable
022  X-Sophos-IBS: success
072  X-SASI-Version: Antispam-Engine: 5.1.4, AntispamData: 192.168.30.105116
018  X-SASI-RCODE: 200
028  X-SASI-SpamProbability: 30%
2142  X-SASI-Hits: BODYTEXTH_SIZE_10000_LESS 0.000000, BODY_SIZE_1000_LESS
0.000000,
 BODY_SIZE_2000_LESS 0.000000, BODY_SIZE_5000_LESS 0.000000,
 BODY_SIZE_500_599 0.000000, BODY_SIZE_7000_LESS 0.000000,
 CTE_QUOTED_PRINTABLE 0.000000, CTYPE_JUST_HTML 0.500000,
 FRAUD_WEBMAIL_R_NOT_F 0.100000, FRAUD_X3 1.000000, FROM_NAME_PHRASE 0.000000,
 HREF_LABEL_TEXT_NO_URI 0.000000, HREF_LABEL_TEXT_ONLY 0.000000,
 HTML_NO_HTTP 0.100000, KNOWN_MTA_TFX 0.000000, NO_CTA_URI_FOUND 0.000000,
 NO_URI_HTTPS 0.000000, RCVD_EXIM_IP_PORT 1.000000,
 REPLYTO_FROM_DIFF_ADDY 0.100000, SENDER_NO_AUTH 0.000000,
 SINGLE_HREF_URI_IN_BODY 0.000000, SXL_IP_TFX_WM 0.000000,
 TO_DOMAIN_IN_FROMNAME_NOT_SAME 0.000000, TO_DOMAIN_IN_FROM_NOT_SAME 0.000000,
 WEBMAIL_REPLYTO_NOT_FROM 0.500000, __ANY_URI 0.000000,
 __BODY_TEXT_X4 0.000000, __CSHC_NS_B_FN_FA 0.000000, __CT 0.000000,
 __CTE 0.000000, __CTYPE_HTML 0.000000, __CTYPE_IS_HTML 0.000000,
 __DC_PHRASE 0.000000, __FRAUD_BODY_WEBMAIL 0.000000, __FRAUD_COMMON 0.000000,
 __FRAUD_INTRO 0.000000, __FRAUD_REPLY 0.000000, __FRAUD_URGENCY 0.000000,
 __FRAUD_WEBMAIL 0.000000, __FRAUD_WEBMAIL_REPLYTO 0.000000,
 __FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000,
 __FROM_NAME_NOT_IN_BODY 0.000000, __FUR_HEADER 0.000000, __HAS_FROM 0.000000,
 __HAS_HTML 0.000000, __HAS_MSGID 0.000000, __HAS_REPLYTO 0.000000,
 __HEADER_ORDER_FROM 0.000000, __HREF_LABEL_TEXT 0.000000,
 __HTML_AHREF_TAG 0.000000, __MIME_HTML 0.000000, __MIME_HTML_ONLY 0.000000,
 __MIME_TEXT_H 0.000000, __MIME_TEXT_H1 0.000000, __MIME_VERSION 0.000000,
 __MSGID_DATETIME_DOT_HEX16 0.000000, __PART_TYPE_HTML 0.000000,
 __PHISH_SPEAR_GREETING 0.000000, __RCPT_HOST_IN_FROM 0.000000,
 __RCPT_HOST_IN_FROM_NAME 0.000000, __RCVD_EXIM_IP_PORT 0.000000,
 __REPLYTO_GMAIL 0.000000, __SANE_MSGID 0.000000, __SEO_WEBSITE 0.000000,
 __SPEAR_FROM_NAME 0.000000, __STOCK_PHRASE_8 0.000000,
 __SUBJ_ALPHA_END 0.000000, __SUBJ_SHORT 0.000000, __TAG_EXISTS_HTML 0.000000,
 __TO_HOST_IN_FROM 0.000000, __TO_HOST_IN_FROM_NAME 0.000000,
 __TO_MALFORMED_2 0.000000, __TO_NO_NAME 0.000000, __URI_MAILTO 0.000000,
 __URI_NO_WWW 0.000000, __URI_NS 0.000000
030  X-Sophos-Firewall: smtpd v1.0


# exim -Mvb 1qxQSQ-0000I8-1U
1qxQSQ-0000I8-1U-D
<html><head>
<meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
</head>
<body><p>Dear Sir Madam,</p><p>My name is Mohammed Al Amoudi from the Kingd=
om of Saudi Arabia.</p><p>I contacted you because of my interest in your se=
ctor.</p><p>We would like to get an idea of the chances of a successful inv=
estment in your area and for other important business discussions.</p><p>I =
await your urgent response.</p><p>Reply to email address for further discus=
sions <a href=3D"mailto:&#8220;alamoudimohammad5@???">&#8220;alamoudi=
mohammad5@???</a>&#8221;</p></body></html>

On the internal mail server we just see:

--
You are receiving this mail because:
You are on the CC list for the bug.

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-dev-unsubscribe@???
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/