Package: qpsmtpd
Version: 0.84-5
Severity: important
Tags: patch
Hi,
I guess this is two bugs really but the same patch can fix both.
When TLS is in use, qpsmtpd creates a Received header of the form
Received: from 87.114.148.171.plusnet.thn-ag1.dyn.plus.net (HELO
george.localnet) (87.114.148.171)
(smtp-auth username XXELIDEDXXX, mechanism cram-md5)
by tauism.org (qpsmtpd/0.84) with (AES256-SHA encrypted) ESMTPSA; Thu, 02 Aug
2012 23:04:55 +0100
According to RFC 5322, comments may not appear between "with" and the
protocol. The BNF allows only FWS there, not CFWS.
This wholly breaks spam-scanning of authenticated clients with
SpamAssassin. If an authorised client connects from a spammy IP address,
as above, their mail will not be detected as coming from an SMTP Auth
submission as the Qpsmtpd header does not parse correctly, and will
therefore probably be marked as spam.
X-Spam-Status: Yes, score=6.439 tagged_above=-999 required=5
tests=[ RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
RCVD_IN_SORBS_DUL=0.001, RDNS_DYNAMIC=0.982, ....
whereas the correctly formatted header hits on ALL_TRUSTED:
X-Spam-Status: No, score=-24.2 required=5.0 tests=ALL_TRUSTED,...
I'm also not very happy about the amount of detail that Qpsmtpd leaks
into relayed mail such as the names of valid SMTP auth logins.
This detail concerning a host/account pair may well end up being
indexed in public mailing list servers and therefore has significant
security implications. The information should go in the logs but not
in the Received headers.
The attached patch removes both these comment entries from the header.
Nick
diff --git a/lib/Qpsmtpd/SMTP.pm b/lib/Qpsmtpd/SMTP.pm
index 5394646..f7f6367 100644
--- a/lib/Qpsmtpd/SMTP.pm
+++ b/lib/Qpsmtpd/SMTP.pm
@@ -746,8 +746,8 @@ sub received_line {
else { # assume $rc == DECLINED
return "from ".$self->connection->remote_info
." (HELO ".$self->connection->hello_host . ") (".$self->connection->remote_ip
- . ")\n $authheader by ".$self->config('me')." (qpsmtpd/".$self->version
- .") with $sslheader$smtp; ". (strftime('%a, %d %b %Y %H:%M:%S %z', localtime))
+ . ")\n by ".$self->config('me')." (qpsmtpd/".$self->version
+ .") with $smtp; ". (strftime('%a, %d %b %Y %H:%M:%S %z', localtime))
}
}
