Mailing List Archive: Issue with Exim on an IPv6-only host

Issue with Exim on an IPv6-only host

exim-users at exim

Feb 20, 2023, 6:53 AM

Post #1 of 9 (400 views)

Hello there,

Exim is configured to listen only on local interfaces and deliver
_all_ mail to a remote SMTP server requiring TLS and authentication,
with all local mail being sent to single email address.

Here are the four most pertinent lines written to mainlog
(abbreviated, redacted and wrapped):

--8<---------------cut here---------------start------------->8---

H=mail.….com […] TLS error on connection (recv): The TLS connection
was non-properly terminated.

H=mail.….com […] TLS error on connection (send): The specified
session has been invalidated for some reason.

** […] R=all_via_fast_smtp_server T=fast_smtp_server […]: SMTP error
from remote mail server after pipelined MAIL FROM:<[…]> SIZE=1537:
530 5.7.1 Authentication required DT=1m

--8<---------------cuthere---------------end--------------->8---

swaks and openssl's s_client have no problem negotiating TLS and
testing with each shows that there's nothing wrong with the
authentication credentials provided in the conf file.

An effectively identical conf file employed on an IPv4-only host
(running the same version of Debian) also encounters no such problem.

The virtual host provider operates a NAT64/DNS64 service for IPv6-only
hosts which allows only _outbound_ connections to IPv4 only services.
Might this explain why the TLS connection is non-properly terminated?

Yet, swaks and s_client negotiate TLS without a problem. I'm stumped.

A redacted exim4.conf is attached.

Any help/tips/suggestions very much appreciated.

Sebastian

P.S. Exim version 4.94.2 #2 built 13-Jul-2021 […].

Re: Issue with Exim on an IPv6-only host [ In reply to ]

exim-users at exim

Feb 21, 2023, 2:44 AM

Post #2 of 9 (400 views)

On 20/02/2023 14:53, Sebastian Tennant via Exim-users wrote:
> ** […] R=all_via_fast_smtp_server T=fast_smtp_server […]: SMTP error
> from remote mail server after pipelined MAIL FROM:<[…]> SIZE=1537:
> 530 5.7.1 Authentication required DT=1m

You got an SMTP response. You were already talking TLS; the TLS
error basically says that the peer didn't shut it down cleanly
having sent that SMTP response - but that's fine, we got enough.

You didn't authenticate to that peer, and it's insisting that you need to.
--
Cheers,
Jeremy

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: Issue with Exim on an IPv6-only host [ In reply to ]

exim-users at exim

Feb 21, 2023, 3:59 AM

Post #3 of 9 (400 views)

Hello Jeremy,

Thanks for your quick response.

Quoth Jeremy Harris via Exim-users <exim-users@exim.org>
on Tue, 21 Feb 2023 10:44:45 +0000:
> On 20/02/2023 14:53, Sebastian Tennant via Exim-users wrote:
>> ** […] R=all_via_fast_smtp_server T=fast_smtp_server […]: SMTP error
>> from remote mail server after pipelined MAIL FROM:<[…]> SIZE=1537:
>> 530 5.7.1 Authentication required DT=1m
>
> You got an SMTP response. You were already talking TLS; the TLS
> error basically says that the peer didn't shut it down cleanly
> having sent that SMTP response - but that's fine, we got enough.
>
> You didn't authenticate to that peer, and it's insisting that you need to.

You are quite right, and in the time it took for my post to get past
the moderators I've managed to track down the problem.

In fact, it may even be bug.

My (only) transport included the line:

hosts_require_auth = $host_address

and an excerpt from debugging output read:

64:ff9b::426f:434 in hosts_require_auth? no (malformed IPv4 address or address mask)

Exim is treating 64:ff9b::426f:434 as a malformed IPv4 address and
deciding authentication is not required.

A simple workaround (which I've employed) is:

hosts_require_auth = $host

but surely Exim should be able to recognise an IPv6 address when it
sees one?!

Sebastian

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: Issue with Exim on an IPv6-only host [ In reply to ]

exim-users at exim

Feb 21, 2023, 4:24 AM

Post #4 of 9 (400 views)

Hi!

> My (only) transport included the line:
>
> hosts_require_auth = $host_address

try:

hosts_require_auth = <; $host_address

otherwise the : from the v6 address is used as list seperator character.

--
pi@opsec.eu +49 171 3101372 Now what ?

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: Issue with Exim on an IPv6-only host [ In reply to ]

exim-users at exim

Feb 21, 2023, 4:36 AM

Post #5 of 9 (400 views)

On 21/02/2023 11:59, Sebastian Tennant via Exim-users wrote:
> hosts_require_auth = $host

Why not hosts_require_auth = * ?
--
Cheers,
Jeremy

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: Issue with Exim on an IPv6-only host [ In reply to ]

exim-users at exim

Feb 21, 2023, 4:52 AM

Post #6 of 9 (400 views)

Hello Kurt,

Quoth Kurt Jaeger <exim-users@opsec.eu>
on Tue, 21 Feb 2023 13:24:42 +0100:
> Hi!
>
>> My (only) transport included the line:
>>
>> hosts_require_auth = $host_address
>
> try:
>
> hosts_require_auth = <; $host_address
>
> otherwise the : from the v6 address is used as list seperator character.

Ah, of course! Thank you.

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: Issue with Exim on an IPv6-only host [ In reply to ]

exim-users at exim

Feb 21, 2023, 5:40 AM

Post #7 of 9 (400 views)

Hello Jeremy,

Quoth Jeremy Harris via Exim-users <exim-users@exim.org>
on Tue, 21 Feb 2023 12:36:41 +0000:
> On 21/02/2023 11:59, Sebastian Tennant via Exim-users wrote:
>> hosts_require_auth = $host
>
> Why not
>
> hosts_require_auth = *
>
> ?

Indeed. That will work too.

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: Issue with Exim on an IPv6-only host [ In reply to ]

exim-users at exim

Feb 21, 2023, 6:24 AM

Post #8 of 9 (400 views)

Sebastian Tennant via Exim-users <exim-users@exim.org> (Di 21 Feb 2023 12:59:57 CET):
> Hello Jeremy,
>
> hosts_require_auth = $host_address

$host_address likely contains colons, which confuses the parser here.
Use … = <; $host_address

--
Heiko

Re: Issue with Exim on an IPv6-only host [ In reply to ]

exim-users at exim

Feb 21, 2023, 6:56 AM

Post #9 of 9 (400 views)

Hello Heiko,

Quoth Heiko Schlittermann via Exim-users <exim-users@exim.org>
on Tue, 21 Feb 2023 15:24:41 +0100:
> […]
> $host_address likely contains colons, which confuses the parser here.
> Use … = <; $host_address

Yup. That was the problem. Thanks.

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/