On Sun, Sep 04, 2016 at 09:33:26AM -0400, H Benfield wrote:
> Hello all,
>
> I recently upgraded from 5.9-stable to 6.0, then rebuilt from source to
> 6.0-stable. The platform is amd64.
>
> In my smtpd.conf file, when queue encryption is enabled, messages temporarily
> fail with this /var/log/maillog message:
>
> Sep 4 09:16:03 host smtpd[35452]: cf54bd77d0d1a6c4 smtp event=connected
> address=<redacted> host=<redacted>
> Sep 4 09:16:03 host smtpd[35452]: cf54bd77d0d1a6c4 smtp event=starttls
> ciphers="version=TLSv1.2, cipher=ECDHE-RSA-AES128-GCM-SHA256, bits=128"
> Sep 4 09:16:03 host smtpd[35452]: cf54bd77d0d1a6c4 smtp event=authentication
> user=<redacted> result=ok
> Sep 4 09:16:04 host smtpd[35452]: cf54bd77d0d1a6c4 smtp event=message
> msgid=1f6136ab from=<<redacted>> to=<<redacted>> size=461 ndest=1 proto=ESMTP
> Sep 4 09:16:04 host smtpd[35452]: 0000000000000000 mda event=delivery
> evpid=1f6136ab3d1fbaa5 from=<<redacted>> to=<<redacted>> user=<redacted>
> method=maildir delay=1s result=TempFail stat=Cannot get message fd
> Sep 4 09:16:13 host smtpd[35452]: 0000000000000000 mda event=delivery
> evpid=1f6136ab3d1fbaa5 from=<<redacted>> to=<<redacted>> user=<redacted>
> method=maildir delay=10s result=TempFail stat=Cannot get message fd
>
> The issue occured under 6.0 release and stable. By disabling queue
> encryption, the messages are successfully delivered. I have also regenerated
> the queue encryption key but this does not change the behavior.
>
> The error is generated from mda.c but I'm not sure what causes fd == -1. Has
> anyone else experienced this issue?
>
Yes, someone reported this a couple days ago, I have committed a fix.
You can apply the following diff while I figure out what we're going to do.
Index: crypto.c
===================================================================
RCS file: /cvs/src/usr.sbin/smtpd/crypto.c,v
retrieving revision 1.5
diff -u -p -r1.5 crypto.c
--- crypto.c 28 Dec 2015 22:08:30 -0000 1.5
+++ crypto.c 3 Sep 2016 13:56:07 -0000
@@ -42,7 +42,6 @@ size_t crypto_encrypt_buffer(const char
size_t crypto_decrypt_buffer(const char *, size_t, char *, size_t);
static struct crypto_ctx {
- const EVP_CIPHER *cipher;
unsigned char key[KEY_SIZE];
} cp;
@@ -53,7 +52,6 @@ crypto_setup(const char *key, size_t len
return 0;
memset(&cp, 0, sizeof cp);
- cp.cipher = EVP_aes_256_gcm();
/* openssl rand -hex 16 */
memcpy(cp.key, key, sizeof cp.key);
@@ -92,7 +90,7 @@ crypto_encrypt_file(FILE * in, FILE * ou
return 0;
EVP_CIPHER_CTX_init(&ctx);
- EVP_EncryptInit(&ctx, cp.cipher, cp.key, iv);
+ EVP_EncryptInit_ex(&ctx, EVP_aes_256_gcm(), NULL, cp.key, iv);
/* encrypt until end of file */
while ((r = fread(ibuf, 1, CRYPTO_BUFFER_SIZE, in)) != 0) {
@@ -105,7 +103,7 @@ crypto_encrypt_file(FILE * in, FILE * ou
goto end;
/* finalize and write last chunk if any */
- if (!EVP_EncryptFinal(&ctx, obuf, &len))
+ if (!EVP_EncryptFinal_ex(&ctx, obuf, &len))
goto end;
if (len && (w = fwrite(obuf, len, 1, out)) != 1)
goto end;
@@ -172,7 +170,7 @@ crypto_decrypt_file(FILE * in, FILE * ou
EVP_CIPHER_CTX_init(&ctx);
- EVP_DecryptInit(&ctx, cp.cipher, cp.key, iv);
+ EVP_DecryptInit_ex(&ctx, EVP_aes_256_gcm(), NULL, cp.key, iv);
/* set expected tag */
EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, sizeof tag, tag);
@@ -195,7 +193,7 @@ crypto_decrypt_file(FILE * in, FILE * ou
goto end;
/* finalize, write last chunk if any and perform authentication check */
- if (!EVP_DecryptFinal(&ctx, obuf, &len))
+ if (!EVP_DecryptFinal_ex(&ctx, obuf, &len))
goto end;
if (len && (w = fwrite(obuf, len, 1, out)) != 1)
goto end;
@@ -240,7 +238,7 @@ crypto_encrypt_buffer(const char *in, si
len += sizeof iv;
EVP_CIPHER_CTX_init(&ctx);
- EVP_EncryptInit(&ctx, cp.cipher, cp.key, iv);
+ EVP_EncryptInit_ex(&ctx, EVP_aes_256_gcm(), NULL, cp.key, iv);
/* encrypt buffer */
if (!EVP_EncryptUpdate(&ctx, out + len, &olen, in, inlen))
@@ -248,7 +246,7 @@ crypto_encrypt_buffer(const char *in, si
len += olen;
/* finalize and write last chunk if any */
- if (!EVP_EncryptFinal(&ctx, out + len, &olen))
+ if (!EVP_EncryptFinal_ex(&ctx, out + len, &olen))
goto end;
len += olen;
@@ -293,7 +291,7 @@ crypto_decrypt_buffer(const char *in, si
in += sizeof iv;
EVP_CIPHER_CTX_init(&ctx);
- EVP_DecryptInit(&ctx, cp.cipher, cp.key, iv);
+ EVP_DecryptInit_ex(&ctx, EVP_aes_256_gcm(), NULL, cp.key, iv);
/* set expected tag */
EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, sizeof tag, tag);
@@ -304,7 +302,7 @@ crypto_decrypt_buffer(const char *in, si
len += olen;
/* finalize, write last chunk if any and perform authentication check */
- if (!EVP_DecryptFinal(&ctx, out + len, &olen))
+ if (!EVP_DecryptFinal_ex(&ctx, out + len, &olen))
goto end;
ret = len + olen;
--
Gilles Chehade
https://www.poolp.org @poolpOrg
