2

My exim4 vis causing a segfault error on sending an email message whenever I use AUTH LOGIN authentication. However, sending the email using AUTH PLAIN works like a charm. Both auth methods connect to Dovecot authenticator.

Exim4 info:

Exim version 4.92 #3 built 09-Sep-2021 16:25:33
Copyright (c) University of Cambridge, 1995 - 2018
(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2018
Berkeley DB: Berkeley DB 5.3.28: (September  9, 2013)
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc GnuTLS move_frozen_messages Content_Scanning DANE DKIM DNSSEC Event OCSP PRDR PROXY SOCKS SPF TCP_Fast_Open Experimental_ARC Experimental_DCC Experimental_DMARC Experimental_DSN_info
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql sqlite
Authenticators: cram_md5 cyrus_sasl dovecot plaintext spa tls
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Malware: f-protd f-prot6d drweb fsecure sophie clamd avast sock cmdline
Fixed never_users: 0
Configure owner: 0:0
Size of off_t: 8
Configuration file search path is /etc/exim4/exim4.conf:/var/lib/exim4/config.autogenerated
Configuration file is /var/lib/exim4/config.autogenerated

Here is the segfault message:

Sep 13 12:57:36 tornavacas kernel: exim4[12679]: segfault at 0 ip 00007fdd2d854206 sp 00007ffe23909ac8 error 4 in libc-2.28.so[7fdd2d7de000+148000]
Sep 13 12:57:36 tornavacas kernel: Code: 0f 1f 40 00 66 0f ef c0 66 0f ef c9 66 0f ef d2 66 0f ef db 48 89 f8 48 89 f9 48 81 e1 ff 0f 00 00 48 81 f9 cf 0f 00 00 77 6a <f3> 0f 6f 20 66 0f 74 e0 66 0f d7 d4 85 d2 74 04 0f bc c2 c3 48 83

And here is the last lines of a strace output:

[pid 16595] munmap(0x7f5e7f800000, 2097152) = 0
[pid 16595] munmap(0x7f5e7df65000, 331776) = 0
[pid 16595] munmap(0x7f5e7fb1a000, 135168) = 0
[pid 16595] exit_group(1)               = ?
[pid 16595] +++ exited with 1 +++
[pid 16592] <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 1}], 0, NULL) = 16595
[pid 16592] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16595, si_uid=106, si_status=1, si_utime=2, si_stime=1} ---
[pid 16592] alarm(0)                    = 30
[pid 16592] rt_sigaction(SIGCHLD, {sa_handler=SIG_IGN, sa_mask=[CHLD], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f5c6ba6b840}, {sa_handler=SIG_DFL, sa_mask=[CHLD], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f5c6ba6b840}, 8) = 0
[pid 16592] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 16592] +++ killed by SIGSEGV +++
<... select resumed> )                  = ? ERESTARTNOHAND (To be restarted if no handler)
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=16592, si_uid=106, si_status=SIGSEGV, si_utime=0, si_stime=1} ---
rt_sigaction(SIGCHLD, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f5c6bc07730}, NULL, 8) = 0
rt_sigreturn({mask=[]})                 = -1 EINTR (Interrupted system call)
wait4(-1, [{WIFSIGNALED(s) && WTERMSIG(s) == SIGSEGV}], WNOHANG, NULL) = 16592
wait4(-1, 0x7fff60755674, WNOHANG, NULL) = -1 ECHILD (No child processes)
rt_sigaction(SIGCHLD, {sa_handler=0x55cf02123500, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f5c6bc07730}, NULL, 8) = 0
select(11, [3 4 5 6 7 8 9 10], NULL, NULL, NULL

Here is how I am reproducing the problem:

#!/usr/bin/expect

set timeout 30
proc abort {} { exit 2 }

spawn nc tornavacas.domain.com 587
expect default abort "220 "
send "EHLO mypc\r"
expect default abort "\n250 "
send "AUTH LOGIN\r"
expect default abort "\n334 "
send "ZGlzZ3Vpc2VkQGRvbWFpbi5jb20=\r"
expect default abort "\n334 "
send "cGFzc3dvcmQ=\r"
send "MAIL FROM:disguised@domain.com\r"
expect default abort "\n250 "
send "RCPT TO:disguised@domain.com\r"
expect default abort "\n250 "
send "DATA\r"
expect default abort "\n354 "
send "Subject: Mensaje de prueba de Microsoft Outlook\r"
send "\r"
send "This is a multipart message in MIME format.\r"
send ".\r"
expect default abort "\n250 "
send "QUIT\r"

On executing this script, I get the following output:

../..
DATA
354 Enter message, ending with "." on a line by itself
Subject: Mensaje de prueba de Microsoft Outlook

This is a multipart message in MIME format.
.

Nonetheless, if I send the same message using AUTH PLAIN, it works:

#!/usr/bin/expect

set timeout 30
proc abort {} { exit 2 }

spawn nc tornavacas.domain.com 587
expect default abort "220 "
send "EHLO mypc\r"
expect default abort "\n250 "
send "AUTH PLAIN AGRpc2d1aXNlZEBkb21haW4uY29tAHBhc3N3b3Jk\r"
expect default abort "\n235 "
send "MAIL FROM:disguised@domain.com\r"
expect default abort "\n250 "
send "RCPT TO:disguised@domain.com\r"
expect default abort "\n250 "
send "DATA\r"
expect default abort "\n354 "
send "Subject: Mensaje de prueba de Microsoft Outlook\r"
send "\r"
send "This is a multipart message in MIME format.\r"
send ".\r"
expect default abort "\n250 "
send "QUIT\r"

The output for the above command is this:

DATA
354 Enter message, ending with "." on a line by itself
Subject: Mensaje de prueba de Microsoft Outlook

This is a multipart message in MIME format.
.
250 OK id=1mPk9v-0004O2-Bp

As you can see, now the email server replies with the 250 code, whereas before it did not replied at all as it died.

The thing is authentication is working in both cases, but something changes when the user authenticates himself using LOGIN method instead of PLAIN one.

I would like to support both methods. Do you have any idea about what could be the cause of the segfault error after using AUTH LOGIN?

Update

I have been investigating a little bit more, and I have found that the cause of the problem is in the check_data ACL, particularly in the following snippet:

  warn add_header = :at_start: ${authresults {$primary_hostname}}

Theoretically, that line should only add to the email a header with the authresults expansion item. However, on commenting it out, the segfault did not happen whereas it does if the warn directive is active.

Warm regards,

1 Answer 1

0

I found that the cause of the problem was in the check_data ACL, particularly in the following snippet:

warn add_header = :at_start: ${authresults {$primary_hostname}}

Theoretically, that line should only add to the email a header with the authresults expansion item. However, on commenting it out, the segfault did not happen whereas it does if the warn directive is active.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.