Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. exim>
  3. users
Exim, OAUTH2 and gnutls problem
exim-users at exim
Mar 5, 2023, 7:59 AM
Post #1 of 6 (233 views)
Permalink
Hello,

This is my first post to this list. This is partly to report that I have
OAuth2 working with office 365 smtp servers, but mainly to ask for help
in diagnosing a TLS error which I think is probably unrelated.

I would have posted to one of the existing threads, but the archive
"reply" button does not work, and I do not know how to join a thread
only active before I subscribed to the list.

I am using a somewhat adapted exim.conf.template using debian testing.

While testing, I have encountered two apparently benign error messages:

1) H=outlook.xx.office365.com [xx.xx.xxx.xxx] TLS error on connection (recv):
Error in the pull function.

That was after a succesful delivery using XOAUTH2 to the ms SMTP server.
At first I thought that it might be some quirk of the MS XOAUTH
implementation.
But the I discovered somewhat similar report during a delivery to an "ordinary",
smarthost:

2) H=mail.xx.xxinternet.com [xxx.xxx.xx.x] TLS error on connection (recv): The TLS connection was non-properly terminated.

I am using the debian light binary, and have gathered some debugging
information using the -dall+tls+auth+transport+timestamp option.
A trimmed and redacted version is attached (as a gzipped text file): I hope
this list allows attachments..

That report of an otherwise successful OAUTH2 delivery to the office365
server shows that the error is coming from gnutls_record_recv:
"14:53:07 tls_read: err from gnutls_record_recv"

It appears to be harmless, but I am no expert on TLS, so I am seeking
any help or comments. I plan to upload my script (shell + gawk) to
Gitlab, but want to sort out this error first, although, as I say, I
suspect that it is unrelated.

ael

Attached Files:

Re: Exim, OAUTH2 and gnutls problem [ In reply to ]
exim-users at exim
Mar 5, 2023, 10:52 AM
Post #2 of 6 (233 views)
Permalink
On 05/03/2023 15:59, ael via Exim-users wrote:
> While testing, I have encountered two apparently benign error messages:
>
> 1) H=outlook.xx.office365.com [xx.xx.xxx.xxx] TLS error on connection (recv):
> Error in the pull function.

Yes, the GnuTLS library produces this somewhat obscure message when
a read it's trying to do on the underlying TCP socket returns an
error to it. The error can be, and most often is "the far end
closed the TCP connection" when GnuTLS is expecting a proper, graceful
notification that the TLS layer is being closed.

So long as the mail message was apparently transferred properly you
can ignore this one.

Your debug shows SMTP-leve success responses for both the data
phase for the message and the SMTP QUIT after it.
--
Cheers,
Jeremy


--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Exim, OAUTH2 and gnutls problem [ In reply to ]
exim-users at exim
Mar 5, 2023, 12:50 PM
Post #3 of 6 (233 views)
Permalink
On Sun, Mar 05, 2023 at 06:52:04PM +0000, Jeremy Harris via Exim-users wrote:
> On 05/03/2023 15:59, ael via Exim-users wrote:
> > While testing, I have encountered two apparently benign error messages:
> >
> > 1) H=outlook.xx.office365.com [xx.xx.xxx.xxx] TLS error on connection (recv):
> > Error in the pull function.
>
> Yes, the GnuTLS library produces this somewhat obscure message when
> a read it's trying to do on the underlying TCP socket returns an
> error to it. The error can be, and most often is "the far end
> closed the TCP connection" when GnuTLS is expecting a proper, graceful
> notification that the TLS layer is being closed.
>
> So long as the mail message was apparently transferred properly you
> can ignore this one.
>
> Your debug shows SMTP-leve success responses for both the data
> phase for the message and the SMTP QUIT after it.

Yes. All the messages are successfully delivered. Thank you for
confirming what I had suspected: the messages are essentially spurious,
although perhaps revealing that some SMTP servers don't close properly:
the usual suspects.. :-)

Very useful reply. Thank you so much. Now I can get back to worrying
about what licence to select and adding a bit more documentation before
uploading to Gitlab.

I will try to remember to post the link to the repository here if anyone
would like it.

Thanks again,


ael


--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Exim, OAUTH2 and gnutls problem [ In reply to ]
exim-users at exim
Mar 5, 2023, 1:51 PM
Post #4 of 6 (233 views)
Permalink
On Sun, Mar 05, 2023 at 08:50:24PM +0000, ael via Exim-users wrote:

> > Your debug shows SMTP-leve success responses for both the data
> > phase for the message and the SMTP QUIT after it.
>
> Thank you for confirming what I had suspected: the messages are
> essentially spurious, although perhaps revealing that some SMTP
> servers don't close properly: the usual suspects.. :-)

Because SMTP has application layer protocol message framing (SMTP
commands and responses), there is no need to lean on TLS to defend
against message truncation. Since process and connection slots are a
finite resource, many SMTP do not bother with SSL shutdown, and just
tear down the TCP connection immediately after sending the "QUIT"
command or response.

Exim would ideally not log TLS errors related to connection tear down,
they have no relevance to SMTP.

--
Viktor.

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Exim, OAUTH2 and gnutls problem [ In reply to ]
exim-users at exim
Mar 9, 2023, 2:57 AM
Post #5 of 6 (233 views)
Permalink
On Sun, 5 Mar 2023, ael via Exim-users wrote:

> Hello,
>
> This is my first post to this list. This is partly to report that I have
> OAuth2 working with office 365 smtp servers,

This is a suprise to me; as far as I know exim does not support OAUTH2.
Are you using some extension such as
https://github.com/pcw11211/exim4-oauth2 ?

--
Andrew C. Aitchison Kendal, UK
andrew@aitchison.me.uk

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Exim, OAUTH2 and gnutls problem [ In reply to ]
exim-users at exim
Mar 9, 2023, 4:16 AM
Post #6 of 6 (233 views)
Permalink
On Thu, Mar 09, 2023 at 10:57:21AM +0000, Andrew C Aitchison via Exim-users wrote:
> On Sun, 5 Mar 2023, ael via Exim-users wrote:
> > This is my first post to this list. This is partly to report that I have
> > OAuth2 working with office 365 smtp servers,
>
> This is a suprise to me; as far as I know exim does not support OAUTH2.
> Are you using some extension such as
> https://github.com/pcw11211/exim4-oauth2 ?

I tried that, but could not get it to work with the office 365 system.
I used the basic idea to write my own version. Mine should be a
little more flexible and maybe could be adapted to work with other
systems like gmail/google but I have not tried to do that. I have
already spent too much of my time on this :-) The RFC6749 really is
pretty poor and allows so many variations that it is hard to write a
general OAUTH2 utility.

Anyway, I have spent a fair bit of time over the last few days adding
some documentation. I then need to decide on a licence, probably
gpl. After that I will push it to Gitlab and maybe others can extend or
improve it if needed.

ael


--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal