Hi, After rebuilding my systems after the latest openssl/iret handler I noticed some incoming email sessions were failing. The failures were primarily from hotmail.com, outlook.com, google.com and me.com. The SMTP server [sendmail v 8.15.2] logs contained lines like this:
Aug 27 14:41:22 tusk sm-mta[18366]: t7REfKQd018366: col004-omc4s12.hotmail.com [65.55.34.214] did not issue MAIL/EXPN/VRFY/ETRN during connection to IPv4 I captured some packets with tcpdump and read them with wireshark. The failed session packets' contents indicated after the SYN, SYN, ACK 3-way handshake I would send out Response: milter_negotiate(milter-regex): send: version 6, fflags 0x1ff, pflags 0x1fffff\n I then rec'd an ACK from the client and then I would send out more milter data like: Response: milter_negotiate(milter-regex): received: version 6, fflags 0x20, pflags 0x300\n Response: milter_negotiate(opendkim): send: version 6, fflags 0x1ff, pflags 0x1fffff\n Response: milter_negotiate(opendkim): received: version 6, fflags 0x111, pflags 0x100702\n Response: milter_negotiate(smf-spf): send: version 6, fflags 0x1ff, pflags 0x1fffff\n Response: milter_negotiate(smf-spf): received: version 6, fflags 0x1d, pflags 0x350\n Response: milter_negotiate(greylist): send: version 6, fflags 0x1ff, pflags 0x1fffff\n Response: milter_negotiate(greylist): received: version 6, fflags 0x13, pflags 0x100\n Response: milter_negotiate(clmilter): send: version 6, fflags 0x1ff, pflags 0x1fffff\n Response: milter_negotiate(clmilter): received: version 6, fflags 0x31, pflags 0x342\n The client would then ACK and I would send out my normal SMTP greeting: Response: 220 tusk.sgt.com ESMTP Sendmail 8.15.2/8.14.9; Thu, 27 Aug 2015 12:24:38 GMT\r\n Then the client would send a FIN ------------------- Needless to say I was concerned and tried restarting sendmail and associated milters, no change, I kept sending out milter data to the client. I tried reinstalling sendmail from both pkgs and ports, no change. I finally rebooted the system and the problem "went away". There was no problem with incoming hotmail, google, apple emails prior to this latest OS upgrade. uname -a: FreeBSD tusk.sgt.com 9.3-RELEASE-p24 FreeBSD 9.3-RELEASE-p24 #10 r287147: Tue Aug 25 23:19:33 UTC 2015 r...@tusk.sgt.com:/usr/obj/usr/src/sys/SGT93AMD64ZFS amd64 Is this a known problem? Any ideas WTF is [was] going on? Any suggestions on what to do next time it happens [short of rebooting]? Please do not publicly release any of my site/domain specific data. tcpdumpfile attached. Thanks, Rob
tcpdumpfile
Description: Binary data
_______________________________________________ freebsd-security@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
