On 3/8/2011 10:43 AM, Eric Shubert wrote:
> On 03/07/2011 11:24 PM, Eric Broch wrote:
>> On 3/7/2011 3:09 PM, Eric Shubert wrote:
>>> Would someone like to test to see if QMT's implementation of SMTP/TLS
>>> is succeptable to this flaw?
>>> http://marc.info/?l=postfix-users&m=129952854117623&w=2
>>>
>>> This has been discussed on the dovecot list recently, and Timo reports
>>> that dovecot does not have this problem.
>>>
>>
>> Eric S,
>>
>> Here's the output. It may not look good.
>>
>> [root@poweredgeT1052 apps]# ./openssl s_client -quiet -starttls smtp
>> -connect localhost:25
>> 250 AUTH LOGIN PLAIN CRAM-MD5
>> 250 flushed
>>
>> Eric B.
>>
>>
>> ---------------------------------------------------------------------------------
>>
>
> EricB and has done some further testing as well, and it appears that
> both spamdyke and qmail-smtpd suffer from this ailment.
>
> Is there anyone here with any C savvy? If you do and you'd like to
> have a stab at this, please chime in.
>
> I'm going to post this on the spamdyke list, and see what Sam has to
> say about it. I expect he'll be getting it fixed fairly quickly.
>
I wrote a 'C++' program to test this issue but the output was different
than it was when testing with the openssl package. I'm not sure what
would be wrong with my program, if anything (I'm open to suggestions).
Anyway, here's the output from my 'C++' program for both scenarios and
the program below.
Build/Run
g++ -o test text.cpp
./test (server ip) (port)
STARTTLS
220 poweredgeT105.whitehorsetc.com - Welcome to Qmail Toaster Ver. 1.3
SMTP Server ESMTP
ehlo
250-poweredgeT105.whitehorsetc.com - Welcome to Qmail Toaster Ver. 1.3
SMTP Server
250-STARTTLS
250-PIPELINING
250-8BITMIME
250-SIZE 20971520
250 AUTH LOGIN PLAIN CRAM-MD5
STARTTLS
220 Proceed.
STARTTLS/RSET
220 poweredgeT105.whitehorsetc.com - Welcome to Qmail Toaster Ver. 1.3
SMTP Server ESMTP
ehlo
250-poweredgeT105.whitehorsetc.com - Welcome to Qmail Toaster Ver. 1.3
SMTP Server
250-STARTTLS
250-PIPELINING
250-8BITMIME
250-SIZE 20971520
250 AUTH LOGIN PLAIN CRAM-MD5
STARTTLS
RSET
220 Proceed.
# test.cpp
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <iostream>
#include "string.h"
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#define buflen 512
signed int portno = 25;
char hostname[] = "mail.whitehorsetc.com";
char buf[buflen];
int main(int argc, char * argv[])
{
int sd = socket(AF_INET, SOCK_STREAM, 0); /* init socket descriptor */
struct sockaddr_in sin;
struct hostent * host;
char buf[buflen];
sin.sin_family = AF_INET;
if (argc == 3)
{
printf("Proceeding with 2 arguments %s/%s\n", argv[1],argv[2]);
host = gethostbyname(argv[1]);
signed int myport = (signed int)atoi(argv[2]);
sin.sin_port = htons(myport);
}
else
{
printf("Proceeding with no arguments %s/%d\n", hostname,portno);
host = gethostbyname(hostname);
sin.sin_port = htons(portno);
}
memcpy(&sin.sin_addr.s_addr, host->h_addr, host->h_length);
if (connect(sd, (struct sockaddr *)&sin, sizeof(sin)) < 0)
{
perror("connecting");
exit(1);
}
/*
** Wait after connection before readiing from socket
*/
sleep(1);
/*
** Read from socket and and send to terminal so client/server
** interaction can be seen
*/
int len = buflen+1;
memset(buf,'\0',buflen);
len = read(sd,buf,buflen);
write(1,buf,len);
/*
** Send 'ehlo' to smtp server and send to terminal so client/server
** interaction can be seen
*/
memset(buf,'\0',buflen);
strcpy(buf,"ehlo\r\n");
write(1,buf,strlen(buf));
len = write(sd,buf,strlen(buf));
memset(buf,'\0',buflen);
/*
** Wait for reply
*/
sleep(1);
/*
** Read result of 'ehlo' and send to terminal so client/server
** interaction can be seen
*/
len = read(sd,buf,buflen);
write(1,buf,len);
/*
** Send 'starttls' with/without 'rset' and send to terminal so
client/server
** interaction can be seen
*/
memset(buf,'\0',buflen);
//len = sprintf(buf,"STARTTLS%c%c",'\r','\n');
len = sprintf(buf,"STARTTLS%c%cRSET%c%c",'\r','\n','\r','\n');
len = write(sd,buf,len);
write(1,buf,len);
memset(buf,'\0',buflen);
/*
** Wait for reply
*/
sleep(1);
/*
** Read response for 'starttls' and send to terminal so client/server
** interaction can be seen
*/
len = read(sd,buf,buflen);
write(1,buf,len);
len = read(sd,buf,buflen);
write(1,buf,len);
/*
** Close socket
*/
sleep(5);
close(sd);
}
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
