[PATCH] opensmtpd: Fix crash during authentication

[PATCH] opensmtpd: Fix crash during authentication

[Adam Zimmerman]

[-- Attachment #1: Type: text/plain, Size: 1020 bytes --]

Hi all,

I'm running a mail server that I recently migrated to GuixSD, and I
found this issue when trying to get opensmtpd set up.

When using authentication from a table, opensmtpd would crash whenever I
tried to authenticate. I found this patch which fixes the issue. It's
already been merged into the opensmtpd master branch[1], and will be
fixed in the next release which apparently will be around
October/November this year.

[1] https://github.com/OpenSMTPD/OpenSMTPD/pull/835

I also noticed another issue which I'm not 100% sure how to solve
properly. When rebooting the server, opensmtpd fails to start. I think
the reason is that the shepherd service only has '(loopback) listed in
its requirements, and I think it might be trying to start the server
before the network comes up. When I ssh into the server and start it
manually, it works fine.

My first thought was to change the requirements to '(networking), but
could that cause issues for people who only use opensmtpd as a local
delivery server?

- Adam

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-gnu-opensmtpd-Add-patch-to-fix-crash-on-authenticati.patch --]
[-- Type: text/x-patch; name="0001-gnu-opensmtpd-Add-patch-to-fix-crash-on-authenticati.patch", Size: 2650 bytes --]

From 42b7717b167553c10adbed1a0ef405b1accfc87e Mon Sep 17 00:00:00 2001
From: Adam Zimmerman <adam@digitalpirate.ca>
Date: Wed, 6 Jun 2018 14:47:46 -0700
Subject: [PATCH] gnu: opensmtpd: Add patch to fix crash on authentication

* gnu/packages/mail.scm (opensmtpd): Add patch to fix crash
---
 gnu/packages/mail.scm                          |  3 +-
 gnu/packages/patches/opensmtpd-fix-crash.patch | 44 ++++++++++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/opensmtpd-fix-crash.patch

diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index f6dfb3397..c0f4bfbdf 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -1995,7 +1995,8 @@ transfer protocols.")
                                   name "-" version ".tar.gz"))
               (sha256
                (base32
-                "10bsfsnlg9d9i6l2izdnxp05s3ri8fvwzqxvx1jmarc852382619"))))
+                "10bsfsnlg9d9i6l2izdnxp05s3ri8fvwzqxvx1jmarc852382619"))
+              (patches (search-patches "opensmtpd-fix-crash.patch"))))
     (build-system gnu-build-system)
     (inputs
      `(("bdb" ,bdb)
diff --git a/gnu/packages/patches/opensmtpd-fix-crash.patch b/gnu/packages/patches/opensmtpd-fix-crash.patch
new file mode 100644
index 000000000..003016753
--- /dev/null
+++ b/gnu/packages/patches/opensmtpd-fix-crash.patch
@@ -0,0 +1,44 @@
+From 9b5f70b93e038df5446bd37a4adac5a0380748e7 Mon Sep 17 00:00:00 2001
+From: johannes <johannes.brechtmann@gmail.com>
+Date: Wed, 21 Feb 2018 23:57:11 +0100
+Subject: [PATCH] crypt_checkpass: include HAVE_CRYPT_H definition, add NULL
+ check
+
+---
+ openbsd-compat/crypt_checkpass.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/openbsd-compat/crypt_checkpass.c b/openbsd-compat/crypt_checkpass.c
+index dafd2dae..d10b3a57 100644
+--- a/openbsd-compat/crypt_checkpass.c
++++ b/openbsd-compat/crypt_checkpass.c
+@@ -1,5 +1,6 @@
+ /* OPENBSD ORIGINAL: lib/libc/crypt/cryptutil.c */
+ 
++#include "includes.h"
+ #include <errno.h>
+ #ifdef HAVE_CRYPT_H
+ #include <crypt.h>
+@@ -10,6 +11,8 @@
+ int
+ crypt_checkpass(const char *pass, const char *goodhash)
+ {
++	char *c;
++
+ 	if (goodhash == NULL)
+ 		goto fail;
+ 
+@@ -17,7 +20,11 @@ crypt_checkpass(const char *pass, const char *goodhash)
+ 	if (strlen(goodhash) == 0 && strlen(pass) == 0)
+ 		return 0;
+ 
+-	if (strcmp(crypt(pass, goodhash), goodhash) == 0)
++	c = crypt(pass, goodhash);
++	if (c == NULL)
++		goto fail;
++
++	if (strcmp(c, goodhash) == 0)
+ 		return 0;
+ 
+ fail:
+
-- 
2.14.1

Re: [PATCH] opensmtpd: Fix crash during authentication

[Tobias Geerinckx-Rice]

Adam,

Adam Zimmerman wrote:
> When using authentication from a table, opensmtpd would crash 
> whenever I
> tried to authenticate.

Nice.

I guess my passwd auth doesn't count (despite using the ‘table’ 
keyword), as I've never had a problem. Nor have I noticed any 
start-up trouble. I'm probably lucky.

> I found this patch which fixes the issue. It's
> already been merged into the opensmtpd master branch[1], and 
> will be
> fixed in the next release which apparently will be around
> October/November this year.
>
> [1] https://github.com/OpenSMTPD/OpenSMTPD/pull/835

Thanks! Applied with minor changes as 
d6dd64af3743934402616a5fda3f93e3a14a3ab0.

In particular, patch files must also be registered in gnu/local.mk 
and get their own commit message entry.

Kind regards,

T G-R

Re: [PATCH] opensmtpd: Fix crash during authentication

[Clément Lassieur]

Hi Adam,

Adam Zimmerman <adam@digitalpirate.ca> writes:

> Hi all,
>
> I'm running a mail server that I recently migrated to GuixSD, and I
> found this issue when trying to get opensmtpd set up.
>
> When using authentication from a table, opensmtpd would crash whenever I
> tried to authenticate. I found this patch which fixes the issue. It's
> already been merged into the opensmtpd master branch[1], and will be
> fixed in the next release which apparently will be around
> October/November this year.
>
> [1] https://github.com/OpenSMTPD/OpenSMTPD/pull/835
>
> I also noticed another issue which I'm not 100% sure how to solve
> properly. When rebooting the server, opensmtpd fails to start. I think
> the reason is that the shepherd service only has '(loopback) listed in
> its requirements, and I think it might be trying to start the server
> before the network comes up. When I ssh into the server and start it
> manually, it works fine.
>
> My first thought was to change the requirements to '(networking), but
> could that cause issues for people who only use opensmtpd as a local
> delivery server?

I run OpenSMTPD 6.0.3p1 on GuixSD, I use authentication from a table,
and none of the issues you described happened to me.

Here is its configuration:

--8<---------------cut here---------------start------------->8---
pki mail.lassieur.org certificate "/etc/smtpd/certs/fullchain.pem"
pki mail.lassieur.org key "/etc/smtpd/certs/privkey.pem"
table passwd file:/etc/mail/passwd
listen on 0.0.0.0 port 25 tls pki mail.lassieur.org
listen on 0.0.0.0 port 587 tls-require pki mail.lassieur.org auth <passwd>
limit mta for domain gmail.com inet4
accept from local for any relay
reject sender "@lassieur.org" for any
accept from any for any relay via smtp://mail2.lassieur.org
--8<---------------cut here---------------end--------------->8---

I don't understand why your setup would behave differently.  Could you
share a bit more of your configuration?

Clément

[PATCH] opensmtpd: Fix crash during authentication

[Adam Zimmerman]

Hi Clément,

On 2018-06-12 01:54 AM, Clément Lassieur wrote:
> I run OpenSMTPD 6.0.3p1 on GuixSD, I use authentication from a table,
> and none of the issues you described happened to me.

Strange, since the bug report I found in the opensmtpd github repo
seemed to suggest it happened for everyone.

> 
> Here is its configuration:
> 
> --8<---------------cut here---------------start------------->8---
> pki mail.lassieur.org certificate "/etc/smtpd/certs/fullchain.pem"
> pki mail.lassieur.org key "/etc/smtpd/certs/privkey.pem"
> table passwd file:/etc/mail/passwd
> listen on 0.0.0.0 port 25 tls pki mail.lassieur.org
> listen on 0.0.0.0 port 587 tls-require pki mail.lassieur.org auth <passwd>
> limit mta for domain gmail.com inet4
> accept from local for any relay
> reject sender "@lassieur.org" for any
> accept from any for any relay via smtp://mail2.lassieur.org
> --8<---------------cut here---------------end--------------->8---
> 
> I don't understand why your setup would behave differently.  Could you
> share a bit more of your configuration?

I have essentially the same config settings on the submission port:

listen on eth0 port 587 tls-require pki dusk auth <passwd> hostname
$host mask-source

 I wonder if it's related to which specific hash you use. My file uses
sha512crypt (hash starts with $6$).

- Adam

> 
> Clément
> 

Re: [PATCH] opensmtpd: Fix crash during authentication

[Clément Lassieur]

Adam Zimmerman <adam@digitalpirate.ca> writes:

>  I wonder if it's related to which specific hash you use. My file uses
> sha512crypt (hash starts with $6$).

Mine too starts with $6$.

Re: [PATCH] opensmtpd: Fix crash during authentication

[Clément Lassieur]

Clément Lassieur <clement@lassieur.org> writes:

> Hi Adam,
>
> Adam Zimmerman <adam@digitalpirate.ca> writes:
>
>> Hi all,
>>
>> I'm running a mail server that I recently migrated to GuixSD, and I
>> found this issue when trying to get opensmtpd set up.
>>
>> When using authentication from a table, opensmtpd would crash whenever I
>> tried to authenticate. I found this patch which fixes the issue. It's
>> already been merged into the opensmtpd master branch[1], and will be
>> fixed in the next release which apparently will be around
>> October/November this year.
>>
>> [1] https://github.com/OpenSMTPD/OpenSMTPD/pull/835

This person [1] says that it can only be reproduced if linking with -pie
/ configuring with --with-pie.  It doesn't seem to me our case.

[1] https://github.com/OpenSMTPD/OpenSMTPD/issues/833#issuecomment-367368007

Re: [PATCH] opensmtpd: Fix crash during authentication

[Adam Zimmerman]

On 2018-06-12 10:46 AM, Clément Lassieur wrote:
> Clément Lassieur <clement@lassieur.org> writes:
> 
>> Hi Adam,
>>
>> Adam Zimmerman <adam@digitalpirate.ca> writes:
>>
>>> Hi all,
>>>
>>> I'm running a mail server that I recently migrated to GuixSD, and I
>>> found this issue when trying to get opensmtpd set up.
>>>
>>> When using authentication from a table, opensmtpd would crash whenever I
>>> tried to authenticate. I found this patch which fixes the issue. It's
>>> already been merged into the opensmtpd master branch[1], and will be
>>> fixed in the next release which apparently will be around
>>> October/November this year.
>>>
>>> [1] https://github.com/OpenSMTPD/OpenSMTPD/pull/835
> 
> This person [1] says that it can only be reproduced if linking with -pie
> / configuring with --with-pie.  It doesn't seem to me our case.
> 
> [1] https://github.com/OpenSMTPD/OpenSMTPD/issues/833#issuecomment-367368007
> 

Very strange, since I only became aware of the issue after running into
it on GuixSD (I was using Ubuntu/Postfix before). And applying the patch
definitely fixed the problem for me. So weird...