Merge ~sergiodj/ubuntu/+source/exim4:bug1974214-segfault-smtp-delivery-JAMMY into ubuntu/+source/exim4:ubuntu/jammy-devel

[Sergio Durigan Junior]

This MP fixes bug #1974214 in Jammy, which is about exim4 segfaulting while connecting to the secondary MX after the primary MX has deferred the email delivery.

This has been reported and fixed upstream, and the Ubuntu bug reporter already tried these patches and confirmed that they work. It took me a bit of time to come up with a reproducer, but after some failed attempts I was finally able to write step-by-step instructions. You can find them in the bug description, which is an SRU template (since this bug also affects Jammy).

There are two patches required to fix the bug, but they are not complex and shouldn't require too much review time. The annoying part is really reproducing the bug.

You can also find a PPA with the proposed package here:

https://launchpad.net/~sergiodj/+archive/ubuntu/exim4

The build is still running; when it finishes I'll trigger autopkgtests and post the results here.

[Sergio Durigan Junior (sergiodj)]

autopkgtest is OK:

autopkgtest [23:36:21]: @@@@@@@@@@@@@@@@@@@@ summary
basic PASS

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-sergiodj-exim4/?format=plain

[Bryce Harrington (bryce)]

See the kinetic MP for comments.

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Friday, June 03 2022, Bryce Harrington wrote:

> Review: Approve
>
> See the kinetic MP for comments.

Thanks, Bryce.

Uploaded:

$ dput exim4_4.95-4ubuntu2.1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/exim4/exim4_4.95-4ubuntu2.1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/exim4/exim4_4.95-4ubuntu2.1.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading exim4_4.95-4ubuntu2.1.dsc: done.
  Uploading exim4_4.95-4ubuntu2.1.debian.tar.xz: done.
  Uploading exim4_4.95-4ubuntu2.1_source.buildinfo: done.
  Uploading exim4_4.95-4ubuntu2.1_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, bryce
Uploaders: sergiodj, bryce
MP auto-approved

review: Approve

diff --git a/debian/changelog b/debian/changelog
index be86696..7592419 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+exim4 (4.95-4ubuntu2.1) jammy; urgency=medium
+
+  * d/p/lp1974214-segfault-smtp-delivery-0{1,2}.patch: Fix segfault when
+    there's an SMTP delivery attempt following a deferral. (LP: #1974214)
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 03 Jun 2022 17:51:15 -0400
+
 exim4 (4.95-4ubuntu2) jammy; urgency=medium
 
   * d/p/lp1966923-exiqgrep-syntax-error.patch: Fix exiqgrep syntax error,
diff --git a/debian/patches/lp1974214-segfault-smtp-delivery-01.patch b/debian/patches/lp1974214-segfault-smtp-delivery-01.patch
new file mode 100644
index 0000000..1342ae6
--- /dev/null
+++ b/debian/patches/lp1974214-segfault-smtp-delivery-01.patch
@@ -0,0 +1,186 @@
+From: Jeremy Harris <[e-mail]>
+Date: Thu, 19 May 2022 14:23:02 +0100
+Subject: GnuTLS: Do not free the cached creds on transport connection close.
+ Bug 2886
+
+Origin: upstream, https://git.exim.org/exim.git/commitdiff/8c74b00980bc7e3e479e8dfcd7c0008b2ac3f543
+Bug: https://bugs.exim.org/show_bug.cgi?id=2886
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/exim4/+bug/1974214
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004740
+---
+ confs/2011               | 72 ++++++++++++++++++++++++++++++++++++++++++++++++
+ log/2011                 | 13 +++++++++
+ rejectlog/2011           |  3 ++
+ scripts/2000-GnuTLS/2011 | 20 ++++++++++++++
+ src/tls-gnu.c            |  8 ++----
+ 5 files changed, 111 insertions(+), 5 deletions(-)
+ create mode 100644 confs/2011
+ create mode 100644 log/2011
+ create mode 100644 rejectlog/2011
+ create mode 100644 scripts/2000-GnuTLS/2011
+
+diff --git a/confs/2011 b/confs/2011
+new file mode 100644
+index 0000000..eac8ccd
+--- /dev/null
++++ b/confs/2011
+@@ -0,0 +1,72 @@
++# Exim test configuration 2011
++
++SERVER=
++
++keep_environment = PATH:EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK
++add_environment = SSLKEYLOGFILE=DIR/spool/sslkeys
++exim_path = EXIM_PATH
++host_lookup_order = bydns
++spool_directory = DIR/spool
++
++.ifdef SERVER
++log_file_path = DIR/spool/log/SERVER%slog
++.else
++log_file_path = DIR/spool/log/%slog
++.endif
++
++gecos_pattern = ""
++gecos_name = CALLER_NAME
++dns_cname_loops = 9
++chunking_advertise_hosts = *
++
++.ifdef _HAVE_PIPE_CONNECT
++pipelining_connect_advertise_hosts = :
++.endif
++.ifdef _HAVE_DMARC
++dmarc_tld_file =
++.endif
++.ifdef _EXP_LIMITS
++limits_advertise_hosts = !*
++.endif
++
++primary_hostname = test.ex
++
++# ----- Main settings -----
++
++acl_smtp_rcpt = check_rcpt
++
++log_selector = +received_recipients +dkim_verbose
++queue_only
++queue_run_in_order
++
++# ----- ACL -----
++begin acl
++
++check_rcpt:
++  defer	hosts = HOSTIPV4
++  accept
++
++# ----- Routers -----
++
++begin routers
++
++d0:
++  driver =	manualroute
++  route_list =	*	"HOSTIPV4::PORT_D : 127.0.0.1::PORT_D"
++  self =	send
++  transport =	gsmtp
++
++# ----- Transports -----
++
++begin transports
++
++gsmtp:
++  driver =			smtp
++  allow_localhost
++  tls_verify_certificates =	system
++  hosts_require_tls =		*
++
++begin retry
++* * F,5d,10s
++
++# End
+diff --git a/log/2011 b/log/2011
+new file mode 100644
+index 0000000..f0fad26
+--- /dev/null
++++ b/log/2011
+@@ -0,0 +1,13 @@
++1999-03-02 09:44:33 10HmaX-0005vi-00 <= [e-mail] U=CALLER P=local S=sss for [e-mail]
++1999-03-02 09:44:33 Start queue run: pid=pppp
++1999-03-02 09:44:33 10HmaX-0005vi-00 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4]: SMTP error from remote mail server after RCPT TO:<[e-mail]>: 451 Temporary local problem - please try later
++1999-03-02 09:44:33 10HmaX-0005vi-00 => [e-mail] R=d0 T=gsmtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmaY-0005vi-00"
++1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
++1999-03-02 09:44:33 End queue run: pid=pppp
++
++******** SERVER ********
++1999-03-02 09:44:33 Warning: No server certificate defined; will use a selfsigned one.
++ Suggested action: either install a certificate or change tls_advertise_hosts option
++1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port PORT_D
++1999-03-02 09:44:33 H=the.local.host.name (test.ex) [ip4.ip4.ip4.ip4] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no F=<[e-mail]> temporarily rejected RCPT <[e-mail]>
++1999-03-02 09:44:33 10HmaY-0005vi-00 <= [e-mail] H=localhost (test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=[e-mail] for [e-mail]
+diff --git a/rejectlog/2011 b/rejectlog/2011
+new file mode 100644
+index 0000000..b8ae22a
+--- /dev/null
++++ b/rejectlog/2011
+@@ -0,0 +1,3 @@
++
++******** SERVER ********
++1999-03-02 09:44:33 H=the.local.host.name (test.ex) [ip4.ip4.ip4.ip4] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no F=<[e-mail]> temporarily rejected RCPT <[e-mail]>
+diff --git a/scripts/2000-GnuTLS/2011 b/scripts/2000-GnuTLS/2011
+new file mode 100644
+index 0000000..c5504c3
+--- /dev/null
++++ b/scripts/2000-GnuTLS/2011
+@@ -0,0 +1,20 @@
++# Cached CA bundle re-use
++#
++# Preload a message into spool
++exim -odq [e-mail]
++Subject: test
++
++this is a test
++
++****
++#
++# Server to work against
++exim -DSERVER=server -bd -oX PORT_D
++****
++#
++# Send message from spool
++exim -q
++****
++#
++killdaemon
++no_msglog_check
+diff --git a/src/tls-gnu.c b/src/tls-gnu.c
+index 31327c8..01a04be 100644
+--- a/src/tls-gnu.c
++++ b/src/tls-gnu.c
+@@ -1586,6 +1586,9 @@ return lifetime;
+ /* Preload whatever creds are static, onto a transport.  The client can then
+ just copy the pointer as it starts up. */
+ 
++/*XXX this is not called for a cmdline send. But one needing to use >1 conn would benefit,
++and there seems little downside. */
++
+ static void
+ tls_client_creds_init(transport_instance * t, BOOL watch)
+ {
+@@ -3061,8 +3064,6 @@ if (rc != GNUTLS_E_SUCCESS)
+     tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
+     (void) gnutls_alert_send_appropriate(state->session, rc);
+     gnutls_deinit(state->session);
+-    gnutls_certificate_free_credentials(state->lib_state.x509_cred);
+-    state->lib_state = null_tls_preload;
+     millisleep(500);
+     shutdown(state->fd_out, SHUT_WR);
+     for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--;	/* drain skt */
+@@ -3749,9 +3750,6 @@ if (!ct_ctx)	/* server */
+   }
+ 
+ gnutls_deinit(state->session);
+-gnutls_certificate_free_credentials(state->lib_state.x509_cred);
+-state->lib_state = null_tls_preload;
+-
+ tlsp->active.sock = -1;
+ tlsp->active.tls_ctx = NULL;
+ /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
diff --git a/debian/patches/lp1974214-segfault-smtp-delivery-02.patch b/debian/patches/lp1974214-segfault-smtp-delivery-02.patch
new file mode 100644
index 0000000..d99e3aa
--- /dev/null
+++ b/debian/patches/lp1974214-segfault-smtp-delivery-02.patch
@@ -0,0 +1,24 @@
+From: Jeremy Harris <[e-mail]>
+Date: Thu, 19 May 2022 14:24:48 +0100
+Subject: ARC: reset headers before signing for secondary MX. Bug 2886
+
+Origin: upstream, https://git.exim.org/exim.git/commitdiff/5a8015582376ff3cc0c0d034d9237008b10d2164
+Bug: https://bugs.exim.org/show_bug.cgi?id=2886
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/exim4/+bug/1974214
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004740
+---
+ src/arc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/arc.c b/src/arc.c
+index a68ab6e..b150d3a 100644
+--- a/src/arc.c
++++ b/src/arc.c
+@@ -1531,6 +1531,7 @@ void
+ arc_sign_init(void)
+ {
+ memset(&arc_sign_ctx, 0, sizeof(arc_sign_ctx));
++headers_rlist = NULL;
+ }
+ 
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 5103fb5..1461ff3 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -16,3 +16,5 @@
 90_localscan_dlopen.dpatch
 fix_smtp_banner.patch
 lp1966923-exiqgrep-syntax-error.patch
+lp1974214-segfault-smtp-delivery-01.patch
+lp1974214-segfault-smtp-delivery-02.patch