Debian Bug report logs - #390712
A TLS fatal alert has been received: Bad record MAC (observed with Nokia and Sony Ericsson Phones using Symbian)

version graph

Package: exim4-daemon-heavy; Maintainer for exim4-daemon-heavy is Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>; Source for exim4-daemon-heavy is src:exim4.

Reported by: Stian Jordet <stian@jordet.net>

Date: Mon, 2 Oct 2006 17:48:26 UTC

Severity: normal

Tags: fixed-upstream, help

Found in versions exim4/4.63-4, exim4/4.63-8

Fixed in version 4.70-1

Done: Andreas Metzler <ametzler@downhill.at.eu.org>

Bug is archived. No further changes may be made.

Forwarded to http://bugs.exim.org/show_bug.cgi?id=665

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Stian Jordet <stian@jordet.net>:
New Bug report received and forwarded. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Stian Jordet <stian@jordet.net>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: exim4-daemon-heavy: A TLS fatal alert has been received.: Bad record MAC
Date: Mon, 02 Oct 2006 19:39:09 +0200
Package: exim4-daemon-heavy
Version: 4.63-4
Severity: normal


Another one of those beloved tls-bugs. I recently got myself a
SonyEricsson P990 smart phone. When trying to send mail with tls (the
same happens using ssl on port 465), the phone asks me to accept the
certificate, and then says "Secure session failed". I get this in my
Exim log:

2006-10-02 18:49:23 SMTP connection from [192.168.1.8]:59691 I=[193.91.240.190]:25 (TCP/IP connection
count = 1)
2006-10-02 18:49:23 no host name found for IP address 192.168.1.8
2006-10-02 18:49:27 TLS recv error on connection from [192.168.1.8]:59691: A TLS fatal alert has been
received.: Bad record MAC
18:49:27 TLS send error on connection from [192.168.1.8]:59691: The specified session has been
invalidated for some reason.

TLS works fine with Thundebird and Evolution, and did work fine with
my previous smart phone (SE P910), so this may sound like a phone bug.
_But_ when I try to send with tls through a sendmail server, it works
fine. I suspect that this is due to the fact that sendmail uses
openssl, and exim gnutls, but I have no evidence of that.

The error message isn't very helpful neither ("for some reason").

Any insight?

Best regards,
Stian

-- Package-specific info:
Exim version 4.63 #1 built 01-Oct-2006 14:42:48
Copyright (c) University of Cambridge 2006
Berkeley DB: Sleepycat Software: Berkeley DB 4.3.29: (September  6, 2005)
Support for: crypteq iconv() IPv6 PAM Perl GnuTLS move_frozen_messages Content_Scanning Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql
Authenticators: cram_md5 cyrus_sasl plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
Configuration file is /etc/exim4/exim4.conf

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18
Locale: LANG=no_NO, LC_CTYPE=no_NO (charmap=ISO-8859-1)

Versions of packages exim4-daemon-heavy depends on:
ii  exim4-base              4.63-4           support files for all exim MTA (v4
ii  libc6                   2.3.6.ds1-4      GNU C Library: Shared libraries
ii  libdb4.3                4.3.29-6         Berkeley v4.3 Database Libraries [
ii  libgnutls13             1.4.4-1          the GNU TLS library - runtime libr
ii  libldap2                2.1.30-13+b1     OpenLDAP libraries
ii  libmysqlclient15off     5.0.24a-5        mysql database client library
ii  libpam0g                0.79-3.2         Pluggable Authentication Modules l
ii  libpcre3                6.7-1            Perl 5 Compatible Regular Expressi
ii  libperl5.8              5.8.8-6.1        Shared Perl library
ii  libpq4                  8.1.4-7          PostgreSQL C client library
ii  libsasl2                2.1.19.dfsg1-0.5 Authentication abstraction library

exim4-daemon-heavy recommends no packages.

-- no debconf information



Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Marc Haber <mh+debian-packages@zugschlus.de>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #10 received at 390712@bugs.debian.org (full text, mbox):

From: Marc Haber <mh+debian-packages@zugschlus.de>
To: Stian Jordet <stian@jordet.net>, 390712@bugs.debian.org, 390712-submitter@bugs.debian.org
Cc: Marc Haber <mh+debian-packages@zugschlus.de>
Subject: Re: Bug#390712: exim4-daemon-heavy: A TLS fatal alert has been received.: Bad record MAC
Date: Tue, 3 Oct 2006 23:56:17 +0200
tags #390712 help
user exim4@packages.debian.org
usertags #390712 gnutls
thanks

On Mon, Oct 02, 2006 at 07:39:09PM +0200, Stian Jordet wrote:
> Any insight?

unfortunately, no. We're still in dire need of help with GnuTLS.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835



Tags added: help Request was from Marc Haber <mh+debian-packages@zugschlus.de> to control@bugs.debian.org. Full text and rfc822 format available.

Message sent on to Stian Jordet <stian@jordet.net>:
Bug#390712. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Marc Fargas <telenieko@telenieko.com>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #20 received at 390712@bugs.debian.org (full text, mbox):

From: Marc Fargas <telenieko@telenieko.com>
To: Debian Bug Tracking System <390712@bugs.debian.org>
Subject: exim4-daemon-heavy: Same with Nokia E60
Date: Fri, 03 Nov 2006 20:24:16 +0100
Package: exim4-daemon-heavy
Version: 4.63-8
Followup-For: Bug #390712

Hi, same happens with Nokia E60 phone. All other SSL/TLS (imaps, https) Services work
fine when accessed from the phone, only exim fails when trying to send messages.


-- Package-specific info:
Exim version 4.63 #1 built 23-Oct-2006 19:09:47
Copyright (c) University of Cambridge 2006
Berkeley DB: Sleepycat Software: Berkeley DB 4.3.29: (September  6, 2005)
Support for: crypteq iconv() IPv6 PAM Perl GnuTLS move_frozen_messages Content_Scanning Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql
Authenticators: cram_md5 cyrus_sasl plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
Configuration file is /var/lib/exim4/config.autogenerated

-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.17-1-686
Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8)

Versions of packages exim4-daemon-heavy depends on:
ii  debconf [debconf-2.0]   1.5.2            Debian configuration management sy
ii  exim4-base              4.63-8           support files for all exim MTA (v4
ii  libc6                   2.3.6-15         GNU C Library: Shared libraries
ii  libdb4.3                4.3.29-4.1       Berkeley v4.3 Database Libraries [
ii  libgnutls13             1.4.4-2          the GNU TLS library - runtime libr
ii  libldap2                2.1.30-13+b1     OpenLDAP libraries
ii  libmysqlclient15off     5.0.24a-9        mysql database client library
ii  libpam0g                0.79-3.1         Pluggable Authentication Modules l
ii  libpcre3                6.4-2            Perl 5 Compatible Regular Expressi
ii  libperl5.8              5.8.8-4          Shared Perl library
ii  libpq4                  8.1.4-2          PostgreSQL C client library
ii  libsasl2                2.1.19.dfsg1-0.2 Authentication abstraction library

exim4-daemon-heavy recommends no packages.

-- debconf information:
  exim4-daemon-heavy/drec:



Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Marc Haber <mh+pkg-gnutls-maint@zugschlus.de>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #25 received at 390712@bugs.debian.org (full text, mbox):

From: Marc Haber <mh+pkg-gnutls-maint@zugschlus.de>
To: pkg-gnutls-maint@lists.alioth.debian.org
Subject: Help with exim4 #390712, interaction with mobile phones
Date: Tue, 5 Dec 2006 16:16:22 +0100
Hi,

I have an issue with exim4 that can, IMO, clearly be traced to GnuTLS.
Please refer to #390712 for more information.

The original reporter, Stian Jordet <stian@jordet.net>, has a
SonyEricsson P990, and Marc Fargas <telenieko@telenieko.com> reports
the same issue with a Nokia E60 (Software Version 2.0618.06.05
(RM-49)).

I did some testing with Marc, and his phone was perfectly able to do
STARTTLS with an exim compiled against OpenSSL. Both exims were build
on the same Debian unstable system by myself, so I am reasonably sure
that we have a GnuTLS issue here.

Marc is willing to debug with him, and I can also put you in contact
with a close friend of mine who is plagued with the same issue with
his new mobile phone against his exim installation.

If there is anything that I can do to help, please get in touch with
me, and by all means keep me posted.

I am subscribed to pkg-gnutls-maint.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835



Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Hanno 'Rince' Wagner <wagner@rince.de>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #30 received at 390712@bugs.debian.org (full text, mbox):

From: Hanno 'Rince' Wagner <wagner@rince.de>
To: 390712@bugs.debian.org
Subject: Same problem, nearly same hardware
Date: Tue, 5 Dec 2006 17:18:25 +0100
[Message part 1 (text/plain, inline)]
Hi,

I also have a Sony-Ericsson P990i (Germany, non-branded by a phone
provider)

My software versions on the mobile phone are:

PDA Software Version:
CXC162036 R3A04
Phone-Software-Version:
CXC152037 R5A006
Bluetooth Software Version:
CXC162058 R4F01
CDA-Version:
CDA162007/3 R3A03

I have the same problem with Exim - I try to do an smtp auth via
TLS, I get the certificate on the phone and accept to use it, but
then it just doesn't work. On the Exim-Side I only see the following:

2006-12-04 15:01:22 no host name found for IP address 82.113.121.1
2006-12-04 15:01:51 TLS recv error on connection from [82.113.121.1]: A TLS fatal alert has been received.: Bad record MAC
2006-12-04 15:01:51 TLS send error on connection from [82.113.121.1]: The specified session has been invalidated for some reason.

2006-12-04 15:02:44 no host name found for IP address 82.113.106.1
2006-12-04 15:02:51 TLS recv error on connection from [82.113.106.1]: A TLS fatal alert has been received.: Bad record MAC
2006-12-04 15:02:51 TLS send error on connection from [82.113.106.1]: The specified session has been invalidated for some reason.

2006-12-04 16:20:03 no host name found for IP address 82.113.106.1
2006-12-04 16:20:15 TLS recv error on connection from [82.113.106.1]: A TLS fatal alert has been received.: Bad record MAC
2006-12-04 16:20:15 TLS send error on connection from [82.113.106.1]: The specified session has been invalidated for some reason.

Without TLS it works:

2006-12-04 16:23:09 no host name found for IP address 82.113.106.1
2006-12-04 16:23:20 1GrFf4-00085h-Cv <= user@invalid H=([10.68.232.75]) [82.113.106.1] P=esmtpa A=login_server:user@invalid S=563 id=XSbjPMP4Wh8j.hG8LVVBK@invalid

(mail addresses taken out)

Ciao, Hanno
-- 
|  Hanno Wagner  | Member of the HTML Writers Guild  | Rince@IRC      |
| Eine gewerbliche Nutzung meiner Email-Adressen ist nicht gestattet! |
| 74 a3 53 cc 0b 19 - we did it!          |    Generation @           |
#"Die haben eine strategische Luftwaffe, atomgetriebene U-Boote und Arnold
# Schwarzenegger. Und wir? Wir haben nur das hier."
# 	-- "Martians"
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Marc Haber <mh+debian-packages@zugschlus.de>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #35 received at 390712@bugs.debian.org (full text, mbox):

From: Marc Haber <mh+debian-packages@zugschlus.de>
To: Hanno 'Rince' Wagner <wagner@rince.de>, 390712@bugs.debian.org, 390712-submitter@bugs.debian.org
Cc: Marc Haber <mh+debian-packages@zugschlus.de>
Subject: Cloning to libgnutls13
Date: Wed, 13 Dec 2006 08:22:50 +0100
clone #390712 -1
reassign -1 libgnutls13
retitle -1 errors establishing TLS session from Nokia and SE mobile phones
submitter -1 mh+debian-packages@zugschlus.de
block #390712 with -1
thanks

According to the discussion in
http://lists.alioth.debian.org/pipermail/pkg-gnutls-maint/2006-December/000349.html
and previous articles, it has been established that this is a gnutls
issue. I am therefore cloning the bug to libgnutls13.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835



Bug 390712 cloned as bug 402861. Request was from Marc Haber <mh+debian-packages@zugschlus.de> to control@bugs.debian.org. Full text and rfc822 format available.

Blocking bugs of 390712 added: 402861 Request was from Marc Haber <mh+debian-packages@zugschlus.de> to control@bugs.debian.org. Full text and rfc822 format available.

Message sent on to Stian Jordet <stian@jordet.net>:
Bug#390712. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Marc Haber <mh+debian-packages@zugschlus.de>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #47 received at 390712@bugs.debian.org (full text, mbox):

From: Marc Haber <mh+debian-packages@zugschlus.de>
To: Hanno 'Rince' Wagner <wagner@rince.de>, 390712@bugs.debian.org, 390712-submitter@bugs.debian.org
Cc: Marc Haber <mh+debian-packages@zugschlus.de>
Subject: Re: Bug#390712: Same problem, nearly same hardware
Date: Wed, 13 Dec 2006 13:46:51 +0100
On Tue, Dec 05, 2006 at 05:18:25PM +0100, Hanno 'Rince' Wagner wrote:
> I also have a Sony-Ericsson P990i (Germany, non-branded by a phone
> provider)

The P990i seems to have issues when connecting to a GnuTLS server. We
have verified this by having the phone connect to gnutls-serv. The
phone and gnutls-serv negotiate TLS 1.0 with AES128 and SHA-1, and
this seems to be the culprit. The phone does not support TLS 1.1. The
connection works fine when gnutls-serv is configured to use SSL3.0
instead of TLS 1.0, and it works as well when TLS1.0 is allowed but
SHA-1 is forbidden. Unfortunately, the cipher falls back to ARCFOUR
when SHA-1 is forbidden.

In exim, the MAC can only be influenced by modifying the actual source
code, and I have verified that an exim compiled with SHA-1 disabled in
the sources can talk to Hanno's phone.

The GnuTLS people are in on this, and I'll report back as soon as we
have new findings.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835



Message sent on to Stian Jordet <stian@jordet.net>:
Bug#390712. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Stian Jordet <stian@jordet.net>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #55 received at 390712@bugs.debian.org (full text, mbox):

From: Stian Jordet <stian@jordet.net>
To: 390712@bugs.debian.org
Subject: Any progress?
Date: Tue, 01 May 2007 20:40:50 +0200
Hi,

Didn't the gnutls people come to an conclusion on this one? Symbian
phones are so common now, it's weird the gnutls people haven't run into
this themselves :)

Thanks.

Best regards,
Stian




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Marc Haber <mh+debian-packages@zugschlus.de>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #60 received at 390712@bugs.debian.org (full text, mbox):

From: Marc Haber <mh+debian-packages@zugschlus.de>
To: Stian Jordet <stian@jordet.net>, 390712@bugs.debian.org, 390712-submitter@bugs.debian.org
Cc: Marc Haber <mh+debian-packages@zugschlus.de>
Subject: Re: Bug#390712: Any progress?
Date: Sun, 10 Jun 2007 12:41:27 +0200
On Tue, May 01, 2007 at 08:40:50PM +0200, Stian Jordet wrote:
> Didn't the gnutls people come to an conclusion on this one? Symbian
> phones are so common now, it's weird the gnutls people haven't run into
> this themselves :)

Unfortunately, there is still no solution besides disabling SHA-1 in
the exim sources, which I am not prepared to do in Debian's exim
sources.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835



Message sent on to Stian Jordet <stian@jordet.net>:
Bug#390712. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Tim Angus <tim@ngus.net>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #68 received at 390712@bugs.debian.org (full text, mbox):

From: Tim Angus <tim@ngus.net>
To: 390712@bugs.debian.org
Subject: Work around
Date: Sat, 18 Aug 2007 21:07:44 +0100
This also occurs with exim4-daemon-heavy and my Nokia E70 with EPOC
mail.

Since the problem is in GNUTLS, it can be worked around by using
OpenSSL, which is fortunately simply a case of editing debian/rules
such that OPENSSL := 1.

UNfortunately, this isn't so staightforward with -heavy because
apparently linking it with OpenSSL constitutes a GPL violation. You are
thus forced to build an exim4-daemon-custom (and violate the GPL) in
order to get -heavy's features with OpenSSL.




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Nikos Mavrogiannopoulos <nmav@gnutls.org>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #73 received at 390712@bugs.debian.org (full text, mbox):

From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
To: 402861@bugs.debian.org
Cc: 390712@bugs.debian.org
Subject: Re: gnutls
Date: Wed, 24 Oct 2007 11:34:40 +0300
On Monday 22 October 2007, Nikos Mavrogiannopoulos wrote:
> On Sun, Aug 19, 2007 at 08:38:42AM +0200, Andreas Metzler wrote:
> > > Something that might help in debugging without much fuss, would be
> > > to test handshake by enabling other ciphersuites.
> > > That would be for gnutls-serv to only enable:
> > > a. key exchage: DHE-RSA  cipher: 3DES
> > > b. key exchange: DHE-RSA cipher: AES_256_CBC
> > > c. key exchange: RSA cipher ARCFOUR
> > > and return the traces if possible.
> > I have done these three tests (and a fourth against a gnutls-serv with
> > no restrictions for kx and cipher), and have attached the traces.
> > Version of gnutls-bin and libgnutls13 is 1.7.19-1.
> I have no clue what this could be. I only posses a Sony-Ericsson W810 which
> connects to my test gnutls server just fine, so I cannot reproduce or test
> it. If you could find a combination of ciphers, protocols, macs that work
> with these phones, I'd like to see the trace as well. However since I'm
> unable to reproduce I don't expect much.

Ok it seems that with the help of Hanno Wagner I managed to debug this issue.
These clients fail to understand TLS 1.0 record packets with a padding added. 
This only occurs when using non stream ciphers (i.e. not arcfour) and does 
not occur when using SSL 3.0 which does not allow such padding. So one point 
is for users of these devices to report that as bug.

However a fix in gnutls is not easy to do. If we disable the random padding in 
TLS 1.0 we do disable a nice feature of TLS that protects against statistical 
attacks. Thus I'd be against such a fix.

A solution for the clients would be to only allow SSL 3.0 (if they can 
configure it).

What I can do within gnutls is to add a function to disable this protection 
and servers that require maximum compatibility could use it.

(thus gnutls 2.2 will introduce gnutls_session_enable_compatibility_mode() to 
counter client bugs)

regards,
Nikos




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Simon Josefsson <simon@josefsson.org>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #78 received at 390712@bugs.debian.org (full text, mbox):

From: Simon Josefsson <simon@josefsson.org>
To: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Cc: 390712@bugs.debian.org
Subject: Re: gnutls
Date: Mon, 05 Nov 2007 15:56:10 +0100
Nikos wrote:

> Ok it seems that with the help of Hanno Wagner I managed to debug this issue.
> These clients fail to understand TLS 1.0 record packets with a padding added. 
> This only occurs when using non stream ciphers (i.e. not arcfour) and does 
> not occur when using SSL 3.0 which does not allow such padding. So one point 
> is for users of these devices to report that as bug.
> 
> However a fix in gnutls is not easy to do. If we disable the random padding in 
> TLS 1.0 we do disable a nice feature of TLS that protects against statistical 
> attacks. Thus I'd be against such a fix.

Why doesn't this problem happen with OpenSSL?  Does it MAC padding under
some circumstances?  Could GnuTLS do the same?

/Simon




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to "Nikos Mavrogiannopoulos" <nmav@gnutls.org>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #83 received at 390712@bugs.debian.org (full text, mbox):

From: "Nikos Mavrogiannopoulos" <nmav@gnutls.org>
To: "Simon Josefsson" <simon@josefsson.org>
Cc: 390712@bugs.debian.org
Subject: Re: gnutls
Date: Mon, 5 Nov 2007 18:58:57 +0200
OpenSSL does not support random padding. They handle TLS 1.0 padding exactly
as SSL 3.0, thus this issue does not occur there. I believe that random padding
is important feature that avoids statistical attacks on the data, so
it's enabled by default
 in gnutls.

On 11/5/07, Simon Josefsson <simon@josefsson.org> wrote:
> Nikos wrote:
>
> > Ok it seems that with the help of Hanno Wagner I managed to debug this issue.
> > These clients fail to understand TLS 1.0 record packets with a padding added.
> > This only occurs when using non stream ciphers (i.e. not arcfour) and does
> > not occur when using SSL 3.0 which does not allow such padding. So one point
> > is for users of these devices to report that as bug.
> >
> > However a fix in gnutls is not easy to do. If we disable the random padding in
> > TLS 1.0 we do disable a nice feature of TLS that protects against statistical
> > attacks. Thus I'd be against such a fix.
>
> Why doesn't this problem happen with OpenSSL?  Does it MAC padding under
> some circumstances?  Could GnuTLS do the same?
>
> /Simon
>




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Simon Josefsson <simon@josefsson.org>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #88 received at 390712@bugs.debian.org (full text, mbox):

From: Simon Josefsson <simon@josefsson.org>
To: 390712@bugs.debian.org
Subject: Re: gnutls
Date: Wed, 28 Nov 2007 11:28:15 +0100
FYI, the upcoming GnuTLS 2.1.7 have a new API where applications can
provide a string to gnutls to set protocol priorities, and it can be
used to disable padding.  An application could call:

gnutls_priority_set_direct (session, "NORMAL:%COMPAT", NULL, 0);

Instead of calling gnutls_set_default_priority().  This will do the
same, but will also disable padding.  The application could even get
this string from the user or a configuration file, so that not all users
are exposed to the vulnerability by default.  Users that want to disable
padding could then change 'NORMAL' into 'NORMAL:%COMPAT' manually.

/Simon

"Nikos Mavrogiannopoulos" <nmav@gnutls.org> writes:

> OpenSSL does not support random padding. They handle TLS 1.0 padding exactly
> as SSL 3.0, thus this issue does not occur there. I believe that random padding
> is important feature that avoids statistical attacks on the data, so
> it's enabled by default
>  in gnutls.
>
> On 11/5/07, Simon Josefsson <simon@josefsson.org> wrote:
>> Nikos wrote:
>>
>> > Ok it seems that with the help of Hanno Wagner I managed to debug this issue.
>> > These clients fail to understand TLS 1.0 record packets with a padding added.
>> > This only occurs when using non stream ciphers (i.e. not arcfour) and does
>> > not occur when using SSL 3.0 which does not allow such padding. So one point
>> > is for users of these devices to report that as bug.
>> >
>> > However a fix in gnutls is not easy to do. If we disable the random padding in
>> > TLS 1.0 we do disable a nice feature of TLS that protects against statistical
>> > attacks. Thus I'd be against such a fix.
>>
>> Why doesn't this problem happen with OpenSSL?  Does it MAC padding under
>> some circumstances?  Could GnuTLS do the same?
>>
>> /Simon
>>




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Simon Josefsson <simon@josefsson.org>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #93 received at 390712@bugs.debian.org (full text, mbox):

From: Simon Josefsson <simon@josefsson.org>
To: Stian Jordet <stian@jordet.net>, Marc Fargas <telenieko@telenieko.com>, "Hanno 'Rince' Wagner" <wagner@rince.de>
Cc: 402861@bugs.debian.org, 390712@bugs.debian.org
Subject: Nokia/Ericsson MAC padding problem
Date: Mon, 04 Feb 2008 12:09:17 +0100
I believe we have identified that the problem in this bug is the MAC
padding.  We brought this up on the IETF TLS list:

http://thread.gmane.org/gmane.ietf.tls/3079

Pasi forwarded this to the Symbian TLS team, and my understanding is
that it is a known bug with the Symbian TLS implementation.

GnuTLS won't change the default to cater with broken implementations, at
least not without more justification that it is a widespread problem.  I
think this bug can be resolved as 'wontfix'.

Further, GnuTLS 2.2+ provides a mechanism to work around bugs in
implementations.  You should be able to connect the Nokia E90 to
gnutls-serv if you start it as:

$ gnutls-serv --priority "NORMAL:%COMPAT"

Applications can use the following functions to implement similar
behaviour:

  int gnutls_priority_init( gnutls_priority_t*, const char *priority, const char** err_pos);
  void gnutls_priority_deinit( gnutls_priority_t);
  
  int gnutls_priority_set(gnutls_session_t session, gnutls_priority_t);
  int gnutls_priority_set_direct(gnutls_session_t session, const char *priority, const char** err_pos);

I recommend that applications offer a way to set the GnuTLS priority
string in a configuration file, and to default it to 'NORMAL'.  It is
extra good if the application allows users to set the GnuTLS priority on
a per-IP basis, so that administrators doesn't have to decrease security
to cater for a few broken devices.

Given this, I think gnutls has done what it can about this bug, and it
might be appropriate to even close it, rather than leaving it in
wontfix.

Is there anything more we can do about this bug?  Suggestions are most
welcome.

/Simon




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Marc Haber <mh+debian-packages@zugschlus.de>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #98 received at 390712@bugs.debian.org (full text, mbox):

From: Marc Haber <mh+debian-packages@zugschlus.de>
To: Simon Josefsson <simon@josefsson.org>, 390712@bugs.debian.org
Cc: Stian Jordet <stian@jordet.net>, Marc Fargas <telenieko@telenieko.com>, Hanno 'Rince' Wagner <wagner@rince.de>, 402861@bugs.debian.org
Subject: Re: Bug#390712: Nokia/Ericsson MAC padding problem
Date: Mon, 4 Feb 2008 14:12:54 +0100
On Mon, Feb 04, 2008 at 12:09:17PM +0100, Simon Josefsson wrote:
> I believe we have identified that the problem in this bug is the MAC
> padding.  We brought this up on the IETF TLS list:
> 
> http://thread.gmane.org/gmane.ietf.tls/3079
> 
> Pasi forwarded this to the Symbian TLS team, and my understanding is
> that it is a known bug with the Symbian TLS implementation.

At least we know who's at fault here.

> GnuTLS won't change the default to cater with broken implementations, at
> least not without more justification that it is a widespread problem.  I
> think this bug can be resolved as 'wontfix'.

I agree.

> I recommend that applications offer a way to set the GnuTLS priority
> string in a configuration file, and to default it to 'NORMAL'.  It is
> extra good if the application allows users to set the GnuTLS priority on
> a per-IP basis, so that administrators doesn't have to decrease security
> to cater for a few broken devices.

Since mobile phones usually connect with a dynamic IP address, this
will most probably end up with a 0.0.0.0/0.0.0.0 netmask though.

> Given this, I think gnutls has done what it can about this bug, and it
> might be appropriate to even close it, rather than leaving it in
> wontfix.
> 
> Is there anything more we can do about this bug?  Suggestions are most
> welcome.

I'd love to have some permanent reference that can be found by Symbian
device owners and referenced in response to new bug reports.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 3221 2323190




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Simon Josefsson <simon@josefsson.org>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #103 received at 390712@bugs.debian.org (full text, mbox):

From: Simon Josefsson <simon@josefsson.org>
To: Marc Haber <mh+debian-packages@zugschlus.de>
Cc: 390712@bugs.debian.org, Stian Jordet <stian@jordet.net>, Marc Fargas <telenieko@telenieko.com>, "Hanno 'Rince' Wagner" <wagner@rince.de>, 402861@bugs.debian.org
Subject: Re: Bug#390712: Nokia/Ericsson MAC padding problem
Date: Mon, 04 Feb 2008 15:04:56 +0100
Marc Haber <mh+debian-packages@zugschlus.de> writes:

>> I recommend that applications offer a way to set the GnuTLS priority
>> string in a configuration file, and to default it to 'NORMAL'.  It is
>> extra good if the application allows users to set the GnuTLS priority on
>> a per-IP basis, so that administrators doesn't have to decrease security
>> to cater for a few broken devices.
>
> Since mobile phones usually connect with a dynamic IP address, this
> will most probably end up with a 0.0.0.0/0.0.0.0 netmask though.

True..  however some may know which IP addresses are affected, so making
this possible would be useful.  At least I could list the networks of my
3G provider.

>> Given this, I think gnutls has done what it can about this bug, and it
>> might be appropriate to even close it, rather than leaving it in
>> wontfix.
>> 
>> Is there anything more we can do about this bug?  Suggestions are most
>> welcome.
>
> I'd love to have some permanent reference that can be found by Symbian
> device owners and referenced in response to new bug reports.

Good idea.  I'm trying to find a good place in the manual to discuss
'MAC padding' and its interop problems.

/Simon




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Simon Josefsson <simon@josefsson.org>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #108 received at 390712@bugs.debian.org (full text, mbox):

From: Simon Josefsson <simon@josefsson.org>
To: Marc Haber <mh+debian-packages@zugschlus.de>
Cc: 390712@bugs.debian.org, Stian Jordet <stian@jordet.net>, Marc Fargas <telenieko@telenieko.com>, "Hanno 'Rince' Wagner" <wagner@rince.de>, 402861@bugs.debian.org
Subject: Re: Bug#390712: Nokia/Ericsson MAC padding problem
Date: Mon, 04 Feb 2008 15:38:47 +0100
Simon Josefsson <simon@josefsson.org> writes:

>>> Given this, I think gnutls has done what it can about this bug, and it
>>> might be appropriate to even close it, rather than leaving it in
>>> wontfix.
>>> 
>>> Is there anything more we can do about this bug?  Suggestions are most
>>> welcome.
>>
>> I'd love to have some permanent reference that can be found by Symbian
>> device owners and referenced in response to new bug reports.
>
> Good idea.  I'm trying to find a good place in the manual to discuss
> 'MAC padding' and its interop problems.

Added:

http://www.gnu.org/software/gnutls/manual/html_node/On-Record-Padding.html

/Simon




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. Full text and rfc822 format available.

Acknowledgement sent to Marc Fargas <telenieko@telenieko.com>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #113 received at 390712@bugs.debian.org (full text, mbox):

From: Marc Fargas <telenieko@telenieko.com>
To: Marc Haber <mh+debian-packages@zugschlus.de>
Cc: Simon Josefsson <simon@josefsson.org>, 390712@bugs.debian.org, Stian Jordet <stian@jordet.net>, Hanno 'Rince' Wagner <wagner@rince.de>, 402861@bugs.debian.org
Subject: Re: Bug#390712: Nokia/Ericsson MAC padding problem
Date: Mon, 04 Feb 2008 16:25:30 +0100
[Message part 1 (text/plain, inline)]
El lun, 04-02-2008 a las 14:12 +0100, Marc Haber escribió:
> On Mon, Feb 04, 2008 at 12:09:17PM +0100, Simon Josefsson wrote:
> I'd love to have some permanent reference that can be found by Symbian
> device owners and referenced in response to new bug reports.
> 
> Greetings
> Marc

Here's a E60 and N95 owner (and a [currently] broken E61 too) glad to
tests things ;)

The easiest to play with is the N95 as it's my phone but can try stuff
in the E60 also without problem.

So just ask for anything you want me to try ;)

Cheers,
Marc
-- 
http://www.marcfargas.com -- will be finished some day.
[signature.asc (application/pgp-signature, inline)]

Noted your statement that Bug has been forwarded to http://bugs.exim.org/show_bug.cgi?id=665. Request was from Marc Haber <mh+debian-packages@zugschlus.de> to control@bugs.debian.org. (Tue, 15 Jul 2008 17:30:02 GMT) Full text and rfc822 format available.

Changed Bug title to `A TLS fatal alert has been received: Bad record MAC (observed with Nokia and Sony Ericsson Phones using Symbian)' from `exim4-daemon-heavy: A TLS fatal alert has been received.: Bad record MAC'. Request was from Marc Haber <mh+debian-packages@zugschlus.de> to control@bugs.debian.org. (Tue, 15 Jul 2008 17:30:02 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. (Wed, 25 Feb 2009 22:42:07 GMT) Full text and rfc822 format available.

Acknowledgement sent to Alex Owen <r.alex.owen@gmail.com>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. (Wed, 25 Feb 2009 22:42:07 GMT) Full text and rfc822 format available.

Message #122 received at 390712@bugs.debian.org (full text, mbox):

From: Alex Owen <r.alex.owen@gmail.com>
To: 390712@bugs.debian.org
Date: Wed, 25 Feb 2009 22:36:35 +0000
An upstream patch (for a work around) is being tracked at
http://bugs.exim.org/show_bug.cgi?id=665




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. (Mon, 06 Jul 2009 23:33:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Antony Gelberg <antony.gelberg@wayforth.com>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. (Mon, 06 Jul 2009 23:33:02 GMT) Full text and rfc822 format available.

Message #127 received at 390712@bugs.debian.org (full text, mbox):

From: Antony Gelberg <antony.gelberg@wayforth.com>
To: 390712@bugs.debian.org
Subject: Re: Bug#390712: Nokia/Ericsson MAC padding problem
Date: Tue, 7 Jul 2009 00:31:38 +0100
I tried applying the upstream patch and building my own exim4 package (running
Lenny).  This wasn't trivial as I had to work out how to edit the patch to
play nicely with dpatch.

Anyway I built and installed it, added gnutls_compat_mode = true to my config,
and restarted exim.  However I'm getting the same problem with my Nokia E71.

If somebody can tell me what my next debug step should be, I'll feed my
findings back into this report.

Antony




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. (Mon, 06 Jul 2009 23:42:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Antony Gelberg <antony.gelberg@wayforth.com>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. (Mon, 06 Jul 2009 23:42:02 GMT) Full text and rfc822 format available.

Message #132 received at 390712@bugs.debian.org (full text, mbox):

From: Antony Gelberg <antony.gelberg@wayforth.com>
To: 390712@bugs.debian.org
Subject: More info
Date: Tue, 7 Jul 2009 00:39:04 +0100
Okay, I just ran it with -d+tls (having read the patch), and I can see that
the compatibility mode option *is* kicking in - see the log below.  So I'm still
confused as to why it's not working.

Antony

 8104 Connection request from 82.68.107.174 port 44245
 8104 search_tidyup called
 8116 host in rfc1413_hosts? yes (matched "*")
 8116 doing ident callback
 8104 1 SMTP accept process running
 8104 Listening...
 8116 ident connection to 82.68.107.174 failed: Connection timed out
 8116 sender_fullhost = [82.68.107.174]
 8116 sender_rcvhost = [82.68.107.174]
 8116 Process 8116 is handling incoming connection from [82.68.107.174]
 8116 host in host_lookup? yes (matched "*")
 8116 looking up host name for 82.68.107.174
 8116 DNS lookup of 174.107.68.82.in-addr.arpa (PTR) succeeded
 8116 IP address lookup yielded 82-68-107-174.dsl.in-addr.zen.co.uk
 8116 gethostbyname2(af=inet6) returned 4 (NO_DATA)
 8116 gethostbyname2 looked up these IP addresses:
 8116   name=82-68-107-174.dsl.in-addr.zen.co.uk address=82.68.107.174
 8116 checking addresses for 82-68-107-174.dsl.in-addr.zen.co.uk
 8116   82.68.107.174 OK
 8116 sender_fullhost = 82-68-107-174.dsl.in-addr.zen.co.uk [82.68.107.174]
 8116 sender_rcvhost = 82-68-107-174.dsl.in-addr.zen.co.uk ([82.68.107.174])
 8116 set_process_info:  8116 handling incoming connection from
82-68-107-174.dsl.in-addr.zen.co.uk [82.68.107.174]
 8116 host in host_reject_connection? no (option unset)
 8116 host in sender_unqualified_hosts? no (option unset)
 8116 host in recipient_unqualified_hosts? no (option unset)
 8116 host in helo_verify_hosts? no (option unset)
 8116 host in helo_try_verify_hosts? no (option unset)
 8116 host in helo_accept_junk_hosts? no (option unset)
 8116 SMTP>> 220 bonham.vm.bytemark.co.uk ESMTP Exim 4.69 Tue, 07 Jul 2009
00:35:38 +0100
 8116 Process 8116 is ready for new message
 8116 smtp_setup_msg entered
 8116 SMTP<< EHLO [192.168.1.69]
 8116 sender_fullhost = 82-68-107-174.dsl.in-addr.zen.co.uk ([192.168.1.69])
[82.68.107.174]
 8116 sender_rcvhost = 82-68-107-174.dsl.in-addr.zen.co.uk ([82.68.107.174]
helo=[192.168.1.69])
 8116 set_process_info:  8116 handling incoming connection from
82-68-107-174.dsl.in-addr.zen.co.uk ([192.168.1.69]) [82.68.107.174]
 8116 host in pipelining_advertise_hosts? yes (matched "*")
 8116 host in auth_advertise_hosts? yes (matched "*")
 8116 host in tls_advertise_hosts? yes (matched "*")
 8116 SMTP>> 250-bonham.vm.bytemark.co.uk Hello
82-68-107-174.dsl.in-addr.zen.co.uk [82.68.107.174]
 8116 250-SIZE 52428800
 8116 250-PIPELINING
 8116 250-AUTH PLAIN LOGIN
 8116 250-STARTTLS
 8116 250 HELP
 8116 SMTP<< STARTTLS
 8116 initializing GnuTLS as a server
 8116 read D-H parameters from file
 8116 initialized D-H parameters
 8116 certificate file = /etc/exim4/exim.crt
 8116 key file = /etc/exim4/exim.key
 8116 verify certificates = /dev/null size=0
 8116 initialized certificate stuff
 8116 host in tls_verify_hosts? no (option unset)
 8116 host in tls_try_verify_hosts? no (end of list)
 8116 lowering GnuTLS security, compatibility mode
 8116 initialized GnuTLS session
 8116 SMTP>> 220 TLS go ahead
 8116 LOG: MAIN
 8116   TLS error on connection from 82-68-107-174.dsl.in-addr.zen.co.uk
([192.168.1.69]) [82.68.107.174] (gnutls_handshake): A TLS fatal alert has
been received.
 8116 TLS failed to start
 8116 LOG: smtp_connection MAIN
 8116   SMTP connection from 82-68-107-174.dsl.in-addr.zen.co.uk
([192.168.1.69]) [82.68.107.174] closed by EOF
 8116 search_tidyup called
 8104 child 8116 ended: status=0x0
 8104 0 SMTP accept processes now running
 8104 Listening...




Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. (Sat, 08 Aug 2009 00:48:05 GMT) Full text and rfc822 format available.

Acknowledgement sent to Antony Gelberg <antony.gelberg@wayforth.com>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. (Sat, 08 Aug 2009 00:48:05 GMT) Full text and rfc822 format available.

Message #137 received at 390712@bugs.debian.org (full text, mbox):

From: Antony Gelberg <antony.gelberg@wayforth.com>
To: 390712@bugs.debian.org
Subject: Re: Bug#390712: Nokia/Ericsson MAC padding problem
Date: Sat, 8 Aug 2009 01:46:13 +0100
[Message part 1 (text/plain, inline)]
Firstly, I'd like to say that the patch /did/ fix the problem on my Nokia E71.
Specifically, the issue was that my handset had cached an old expired
certificate, and whenever I told it to "always use this certificate", it
didn't have the sense to actually use it over the old one.  Deleting the
expired one from the handset cache fixed the problem.

I've also attached the upstream patch above in dpatch format, so that anybody
reading this can quickly build it - just drop it in debian/patches and add the
patch name to debian/patches/00list.

Antony
[99_gnutls.dpatch (text/plain, attachment)]

Added tag(s) fixed-upstream. Request was from bts-link-upstream@lists.alioth.debian.org to control@bugs.debian.org. (Mon, 19 Oct 2009 19:30:33 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>:
Bug#390712; Package exim4-daemon-heavy. (Sat, 31 Jul 2010 18:15:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Phil Pennock <phil.pennock@spodhuis.org>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>. (Sat, 31 Jul 2010 18:15:03 GMT) Full text and rfc822 format available.

Message #144 received at 390712@bugs.debian.org (full text, mbox):

From: Phil Pennock <phil.pennock@spodhuis.org>
To: 390712@bugs.debian.org
Subject: Re: Bug#390712: Exim fix is upstream
Date: Sat, 31 Jul 2010 13:58:20 -0400
As a step towards closure: the fix was committed to Exim on 2009-10-16
and was included in Exim 4.70.  Current release is 4.72, 4.73 should be
soon.

The only changes for the patch committed upstream were:
 * documentation
 * a different diagnostic for versions of GnuTLS too old to support this
   feature (the option becomes a noop, visible only with debugging).

Regards,
-Phil




Reply sent to Andreas Metzler <ametzler@downhill.at.eu.org>:
You have taken responsibility. (Sat, 16 Apr 2011 12:30:20 GMT) Full text and rfc822 format available.

Notification sent to Stian Jordet <stian@jordet.net>:
Bug acknowledged by developer. (Sat, 16 Apr 2011 12:30:26 GMT) Full text and rfc822 format available.

Message #149 received at 390712-done@bugs.debian.org (full text, mbox):

From: Andreas Metzler <ametzler@downhill.at.eu.org>
To: 390712-done@bugs.debian.org
Subject: Re: Bug#390712: exim4-daemon-heavy: A TLS fatal alert has been received.: Bad record MAC
Date: Sat, 16 Apr 2011 14:29:37 +0200
Version: 4.70-1

On 2006-10-02 Stian Jordet <stian@jordet.net> wrote:
> Package: exim4-daemon-heavy
> Version: 4.63-4
> Severity: normal


> Another one of those beloved tls-bugs. I recently got myself a
> SonyEricsson P990 smart phone. When trying to send mail with tls (the
> same happens using ssl on port 465), the phone asks me to accept the
> certificate, and then says "Secure session failed". I get this in my
> Exim log:

> 2006-10-02 18:49:23 SMTP connection from [192.168.1.8]:59691 I=[193.91.240.190]:25 (TCP/IP connection
> count = 1)
> 2006-10-02 18:49:23 no host name found for IP address 192.168.1.8
> 2006-10-02 18:49:27 TLS recv error on connection from [192.168.1.8]:59691: A TLS fatal alert has been
> received.: Bad record MAC
> 18:49:27 TLS send error on connection from [192.168.1.8]:59691: The specified session has been
> invalidated for some reason.
[...]


4.70 introduced the gnutls_compat_mode main configuration setting
which (inter alia) disables MAC padding.

I do not intend to enable the option by default on exim, since there
are downsides ("This of course will disable protection against
statistical attacks on the data.")

cu andreas




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 15 May 2011 07:32:52 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Mon Apr 21 00:47:51 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.