Mailing List Archive: [Bug 404] New: Exim accepts message after sending server disconnects

http://www.exim.org/bugzilla/show_bug.cgi?id=404

Summary: Exim accepts message after sending server disconnects
Product: Exim
Version: 4.63
Platform: x86
OS/Version: FreeBSD
Status: NEW
Severity: bug
Priority: low
Component: Mail Receipt
AssignedTo: ph10@hermes.cam.ac.uk
ReportedBy: exim-users@eng.ufl.edu
QAContact: exim-dev@exim.org

User started receiving multiple copies of same message. Headers showed that it
was a single message that went from originating server to intermediary server.
Intermediary server kept re-sending message to our server. Operators of
intermediary server say their logs show SMTP exchange was timing out before our
server accepted the message, so it kept re-attempting delivery. Our server
seems to have thought it accepted the message but in fact the sending server
appears to have already timed out and disappeared before the message was
accepted.

We run SpamAssassin (spamd) during SMTP exchange and refuse incoming spam. This
particular message was taking abnormally long time for SA processing (70+
seconds). It appears that there is some sort problem causing Exim to not
realize that the other server is no longer there until after it sends the OK
for the incoming message. This was a TLS connection, Exim logged an SSL error
message so it may be specific to TLS.

Other messages that required abnormally long processing times have not shown
this, but I suspect the sending hosts had longer timeouts in those cases. Our
user received dozens of copies of this message, so I doubt it is a race
condition with a very tight timing constraint.

Log extract showing sample event:

2006-11-01 11:37:33 -0500 1GfJ4X-000KmD-4q SA: Action: scanned but message
isn't spam: score=-2.1 required=5.0 (scanned in 77/77 secs | Message-Id:
F7E967358A5C914C89BA3C4C76348DD60237F53D@ofa-net-021.ad.ufl.edu). From
<xxxxxx@ufl.edu> (host=smtp01.osg.ufl.edu [128.227.74.149]) for
yyyyyy@eng.ufl.edu

2006-11-01 11:37:33 -0500 1GfJ4X-000KmD-4q <= xxxxxx@ufl.edu
H=smtp01.osg.ufl.edu (smtp.ufl.edu) [128.227.74.149] P=esmtps
X=TLSv1:AES256-SHA:256 S=2144096 id=F7E967358A5C914C89BA3C4C76348DD
60237F53D@ofa-net-021.ad.ufl.edu T="RE: thank you"

2006-11-01 11:37:33 -0500 SSL_write error 5

2006-11-01 11:37:33 -0500 SMTP connection from smtp01.osg.ufl.edu
(smtp.ufl.edu) [128.227.74.149] lost

------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.

--
## List details at http://www.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##

Quoting bugzilla-daemon@sesame.csx.cam.ac.uk:

> User started receiving multiple copies of same message. Headers showed that it
> was a single message that went from originating server to intermediary server.
> Intermediary server kept re-sending message to our server. Operators of
> intermediary server say their logs show SMTP exchange was timing out before our
> server accepted the message, so it kept re-attempting delivery. Our server
> seems to have thought it accepted the message but in fact the sending server
> appears to have already timed out and disappeared before the message was
> accepted.

I saw this before (and I think it was discussed once on the users list).
It was caused by a firewall with short timeouts (60s) for its connection
table. After the timeout it discards Exim's "250 OK" reply. The sender
host's network admin raised the timeout (RFC recommends 5 or 10min)
after I mailed this to him and it worked then. There's not much Exim
itself can do about that, I think.

--
## List details at http://www.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##