Mailing List Archive: unexpected eof

unexpected eof

May 23, 2023, 1:40 AM

Post #1 of 3 (141 views)

Hi Guys,

I saw a looooot of these messages in the logs:

2023-05-09 17:46:31 TLS error on connection from
p4ff64002.dip0.t-ipconnect.de [79.246.64.2] (SSL_accept):
error:0A000126:SSL routines::unexpected eof while reading
2023-05-09 17:47:46 TLS error on connection from
p4ff64002.dip0.t-ipconnect.de [79.246.64.2] (SSL_accept): ret 5
2023-05-09 17:49:01 TLS error on connection from
p4ff64002.dip0.t-ipconnect.de [79.246.64.2] (SSL_accept): ret 5

Does anyone know, what kind of Client/SSL bug causes this exact pattern?
(Exim 4.96/OpenSSL 1.1.1)

I know as fact, that some vulnerablility scanner try to find out if
ports using SSL or not, and cause this messages, but the "ret 5" is
missing when they probe it out. The above log is from a client connect
and the specific user is unable to cooperate on finding out, what setup
bug this might cause(if any).

Thanks,
Marius

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: unexpected eof [ In reply to ]

exim-users at lists

May 23, 2023, 7:38 AM

Post #2 of 3 (141 views)

Permalink

On 23/05/2023 09:40, Cyborg via Exim-users wrote:
> I saw a looooot of these messages in the logs:
>
> 2023-05-09 17:46:31 TLS error on connection from p4ff64002.dip0.t-ipconnect.de [79.246.64.2] (SSL_accept): error:0A000126:SSL routines::unexpected eof while reading
> 2023-05-09 17:47:46 TLS error on connection from p4ff64002.dip0.t-ipconnect.de [79.246.64.2] (SSL_accept): ret 5
> 2023-05-09 17:49:01 TLS error on connection from p4ff64002.dip0.t-ipconnect.de [79.246.64.2] (SSL_accept): ret 5
>
> Does anyone know, what kind of Client/SSL bug causes this exact pattern? (Exim 4.96/OpenSSL 1.1.1)

The client closed the TCP connection rather than supplying
a TLS record that the server was expecting (such as one that
cleanly closes a TLS session).
--
Cheers,
Jeremy

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: unexpected eof [ In reply to ]

exim-users at lists

May 23, 2023, 8:05 AM

Post #3 of 3 (141 views)

Permalink

Am 23.05.23 um 16:38 schrieb Jeremy Harris via Exim-users:
> On 23/05/2023 09:40, Cyborg via Exim-users wrote:
>> I saw a looooot of these messages in the logs:
>>
>> 2023-05-09 17:46:31 TLS error on connection from
>> p4ff64002.dip0.t-ipconnect.de [79.246.64.2] (SSL_accept):
>> error:0A000126:SSL routines::unexpected eof while reading
>> 2023-05-09 17:47:46 TLS error on connection from
>> p4ff64002.dip0.t-ipconnect.de [79.246.64.2] (SSL_accept): ret 5
>> 2023-05-09 17:49:01 TLS error on connection from
>> p4ff64002.dip0.t-ipconnect.de [79.246.64.2] (SSL_accept): ret 5
>>
>> Does anyone know, what kind of Client/SSL bug causes this exact
>> pattern? (Exim 4.96/OpenSSL 1.1.1)
>
> The client closed the TCP connection rather than supplying
> a TLS record that the server was expecting (such as one that
> cleanly closes a TLS session).

thanks Jeremy.

best regards,
Marius

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/