[Dovecot] pop3 problem with small messages with no Subject: and no To: headers
Hello, Seeing a strange thing with dovecot 1.0 b7 pop3.
If a user gets a particular _very_ short spam message (not sure what virus makes these..), with NO Subject and NO To: headers and NO body, (example available upon request), the user is unable to download the mail. The log entry is:
May 10 10:51:35 mail dovecot: POP3(user): Disconnected top=0/0, retr=1/1344, del=0/75, size=16383381
There's no QUIT, so no "Logged out" disconnect reason. I did a tcpdump to see what was happening. I have not been able to duplicate this myself yet, even with an exact copy of the message that seems to be causing it, so it could be a client issue, but I've never seen this before, and we just switched to Dovecot, so I thought I'd check with the list.. ideas?
Message #9 is requested (it's the one in the user's box with missing headers). Dovecot begins returning it, but then disconnects, or so it seems.
10:51:35.171916 IP customer.60181 > mailserver.pop3: P 40:48(8) ack 1633
win 65535
0x0000: 4500 0030 d326 4000 7106 fc20 4624 16a1 E..0.&@.q...F$..
0x0010: ceaa 0f11 eb15 006e 7ee7 2a93 d845 fe0c .......n~.*..E..
0x0020: 5018 ffff 3618 0000 5245 5452 2039 0d0a P...6...RETR.9..
10:51:35.172177 IP mailserver.pop3 > customer.60181: P 1633:2980(1347)
ack 48 win 5840
0x0000: 4500 056b ca0b 4000 4006 3101 ceaa 0f11 E..k..@.@.1.....
0x0010: 4624 16a1 006e eb15 d845 fe0c 7ee7 2a9b F$...n...E..~.*.
0x0020: 5018 16d0 3fde 0000 2b4f 4b20 3133 3237 P...?...+OK.1327
0x0030: 206f 6374 6574 730d 0a52 6574 7572 6e2d .octets..Return-
0x0040: 5061 7468 3a20 3c68 7469 3935 6b67 6576 Path:.
That's all, the connection is closed.
Ken A Pacific.Net
A followup..
This may be related to problems some email clients have with malformed headers. Emails that don't have a blank line at the end of the headers seem to cause problems for clients. Any one else deal with this issue? For now, I'm just using SpamAssassin to kill them.
Ken A. Pacific.Net
Ken A wrote:
Hello, Seeing a strange thing with dovecot 1.0 b7 pop3.
If a user gets a particular _very_ short spam message (not sure what virus makes these..), with NO Subject and NO To: headers and NO body, (example available upon request), the user is unable to download the mail. The log entry is:
May 10 10:51:35 mail dovecot: POP3(user): Disconnected top=0/0, retr=1/1344, del=0/75, size=16383381
There's no QUIT, so no "Logged out" disconnect reason. I did a tcpdump to see what was happening. I have not been able to duplicate this myself yet, even with an exact copy of the message that seems to be causing it, so it could be a client issue, but I've never seen this before, and we just switched to Dovecot, so I thought I'd check with the list.. ideas?
Message #9 is requested (it's the one in the user's box with missing headers). Dovecot begins returning it, but then disconnects, or so it seems.
10:51:35.171916 IP customer.60181 > mailserver.pop3: P 40:48(8) ack 1633 win 65535 0x0000: 4500 0030 d326 4000 7106 fc20 4624 16a1 E..0.&@.q...F$.. 0x0010: ceaa 0f11 eb15 006e 7ee7 2a93 d845 fe0c .......n~.*..E.. 0x0020: 5018 ffff 3618 0000 5245 5452 2039 0d0a P...6...RETR.9.. 10:51:35.172177 IP mailserver.pop3 > customer.60181: P 1633:2980(1347) ack 48 win 5840 0x0000: 4500 056b ca0b 4000 4006 3101 ceaa 0f11 E..k..@.@.1..... 0x0010: 4624 16a1 006e eb15 d845 fe0c 7ee7 2a9b F$...n...E..~.*. 0x0020: 5018 16d0 3fde 0000 2b4f 4b20 3133 3237 P...?...+OK.1327 0x0030: 206f 6374 6574 730d 0a52 6574 7572 6e2d .octets..Return- 0x0040: 5061 7468 3a20 3c68 7469 3935 6b67 6576 Path:.
customer.60181: P 1633:2980(1347) ack 48 win 5840 0x0000: 4500 056b ca0d 4000 4006 30ff ceaa 0f11 E..k..@.@.0..... 0x0010: 4624 16a1 006e eb15 d845 fe0c 7ee7 2a9b F$...n...E..~.*. 0x0020: 5018 16d0 3fde 0000 2b4f 4b20 3133 3237 P...?...+OK.1327 0x0030: 206f 6374 6574 730d 0a52 6574 7572 6e2d .octets..Return- 0x0040: 5061 7468 3a20 3c68 7469 3935 6b67 6576 Path:. mailserver.pop3: F 48:48(0) ack 2980 win 64188 0x0000: 4500 0028 d329 4000 7106 fc25 4624 16a1 E..(.)@.q..%F$.. 0x0010: ceaa 0f11 eb15 006e 7ee7 2a9b d846 034f .......n~.* ..F.O 0x0020: 5011 fabc 09fa 0000 0000 0000 0000 P............. 10:51:35.470997 IP mailserver.pop3 > customer.60181: F 2980:2980(0) ack 49 win 5840 0x0000: 4500 0028 ca0f 4000 4006 3640 ceaa 0f11 E..(..@.@.6@.... 0x0010: 4624 16a1 006e eb15 d846 034f 7ee7 2a9c F$...n...F.O~.*. 0x0020: 5011 16d0 ede5 0000 P....... 10:51:35.515279 IP customer.60181 > mailserver.pop3: . ack 2981 win 64188 0x0000: 4500 0028 d32e 4000 7106 fc20 4624 16a1 E..(..@.q...F$.. 0x0010: ceaa 0f11 eb15 006e 7ee7 2a9c d846 0350 .......n~.*..F.P 0x0020: 5010 fabc 09f9 0000 0000 0000 0000 P.............That's all, the connection is closed.
Ken A Pacific.Net
participants (1)
-
Ken A