Bug 895552

Summary: starttls greylist bypass broken since sendmail 8.14.6
Product: [Fedora] Fedora Reporter: Fabrice Bellet <fabrice>
Component: sendmailAssignee: Jaroslav Škarvada <jskarvad>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 18CC: jskarvad, mlichvar, rh-bugzilla, vanmeeuwen+fedora
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-02-05 03:14:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Proposed fix none

Description Fabrice Bellet 2013-01-15 14:04:23 UTC 
Since sendmail-8.14.6, it seems that the test in milter-greylist.c:480 to bypass greylisting if starttls authentication succeeded now fails:

- with 8.14.5-15, it works (the three lines are debug stuff from my own build):

c_noauth=0
verify=OK
cert_subject=/C=FR/ST=Rhone/L=Lyon/CN=bellet.info/emailAddress=fabrice
STARTTLS succeeded for DN="/C=FR/ST=Rhone/L=Lyon/CN=bellet.info/emailAddress=fabrice", bypassing greylisting

- with 8.14.6-1, smfi_getsymval() returns null strings instead, although starttls authentication is still ok inside sendmail.

c_noauth=0
verify=(null)
cert_subject=(null)
r0FDqAbE010377: addr xxx.xxx.xxx.xxx from <bellet> rcpt <fabrice>: autowhitelisted for 72:00:00
Comment 1 Fabrice Bellet 2013-01-16 16:35:17 UTC 
I reassign to sendmail, because the problem with milter-greylist is caused by a modification in the milter code between sendmail-8.14.5 and sendmail-8.14.6 :

--- sendmail-8.14.5/sendmail/milter.c	2009-11-06 01:57:06.000000000 +0100
+++ sendmail-8.14.6/sendmail/milter.c	2012-11-16 21:25:03.000000000 +0100
@@ -4078,7 +4048,7 @@ milter_helo(helo, e, state)
 	}
 
 	response = milter_command(SMFIC_HELO, helo, strlen(helo) + 1,
-				  MilterHeloMacros, e, state, "helo", false);
+				  SMFIM_EOH, e, state, "helo", false);
 	milter_per_connection_check(e);
 	return response;
 }

the correct macro index in this case should be SMFIM_HELO, not SMFIM_EOH.
Comment 2 Jaroslav Škarvada 2013-01-16 18:02:54 UTC 
Thanks,

problem reported upstream.
Comment 3 Jaroslav Škarvada 2013-01-16 20:39:31 UTC 
Problem confirmed upstream.
Comment 4 Jaroslav Škarvada 2013-01-16 20:46:42 UTC 
Created attachment 679830 [details]
Proposed fix
Comment 5 Fabrice Bellet 2013-01-16 21:59:04 UTC 
The proposed fix works for me. Thanks!
Comment 6 Jaroslav Škarvada 2013-01-16 22:04:52 UTC 
OK, building the Fedora update.

You will be credited in the next upstream release.
Comment 7 Fedora Update System 2013-01-17 10:53:45 UTC 
sendmail-8.14.6-2.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/sendmail-8.14.6-2.fc18
Comment 8 Fedora Update System 2013-01-20 03:14:24 UTC 
Package sendmail-8.14.6-2.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing sendmail-8.14.6-2.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-1072/sendmail-8.14.6-2.fc18
then log in and leave karma (feedback).
Comment 9 Fedora Update System 2013-02-05 03:14:34 UTC 
sendmail-8.14.6-2.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.