Text 26307, 170 rader
Skriven 2015-07-28 12:17:56 av Matt Bedynek (1:19/10)
  Kommentar till text 26306 av Björn Felten (2:203/2)
Ärende: Routing 200MB of echomail via an unsuspecting system
============================================================
Björn,

Tuesday July 28 2015 18:44, you wrote to me:

 BF>    I've been using squishmail -- and still am, since it's now open
 BF> source and I can fix any anomalies I can find (none so far) -- for
 BF> decades now, and it will NOT route echomail, I can assure you that.

 BF>    The challenge is open to you too...

I created a "lab" because I would have access to the logs immediately.

1.  Intermediate host:

- Original Squishmail 1.11 configured as 1:19/10.
- A single echo, FIDONEWS, with links to 1:106/2 and 1:396/45.
- The route.cfg contained send statements for 1:106/2 and 1:396/45 so mail to
those nodes is sent direct.
- It also contained route statement to send everything ellse via 1:396/1.

2.  I created the following packets:

(Note: This is a normal echomail message.  The Pkt DestAddr and Msg DestAddr
are the same)
Pkt-Name:     55b7b7d8.pkt
OrigAddr:     1:106/2.0
DestAddr:     1:19/10.0
pkt created:  Tue Jul 28 13:11:52 2015
pkt Password:
prodCode:     10ff
prodRevision  1.9
----------------------------------------
Msg: 106/2 -> 19/10
--Text----
AREA:FIDONEWS
MSGID: 1:106/2 55b7b7d9
PID: txt2pkt/fbsd 1.9.0-cur 25-05-15
TID: txt2pkt/fbsd 1.9.0-cur 25-05-15
Testing routed echomail
 + Origin: normal linked echo msg (1:106/2.0)
SEEN+BY: 106/2
PATH: 106/2


(Note: This is a normal echomail msg except the destination address on the
message itself has been changed)
Pkt-Name:     55b7b80c.pkt
OrigAddr:     1:106/2.0
DestAddr:     1:19/10.0
pkt created:  Tue Jul 28 13:12:44 2015
pkt Password:
prodCode:     10ff
prodRevision  1.9
----------------------------------------
Msg: 106/2 -> 100/1
--Text----
AREA:FIDONEWS
MSGID: 1:106/2 55b7b80d
PID: txt2pkt/fbsd 1.9.0-cur 25-05-15
TID: txt2pkt/fbsd 1.9.0-cur 25-05-15
Testing routed echomail
 + Origin: msg with different dest addr (1:106/2.0)
SEEN+BY: 106/2
PATH: 106/2


(Note: This is an echo which was not defined in squish.cfg - should get tossed
to bad right?)
Pkt-Name:     55b7b819.pkt
OrigAddr:     1:106/2.0
DestAddr:     1:19/10.0
pkt created:  Tue Jul 28 13:12:57 2015
pkt Password:
prodCode:     10ff
prodRevision  1.9
----------------------------------------
Msg: 106/2 -> 100/1
--Text----
AREA:OTHERECHO
MSGID: 1:106/2 55b7b81a
PID: txt2pkt/fbsd 1.9.0-cur 25-05-15
TID: txt2pkt/fbsd 1.9.0-cur 25-05-15
Testing routed echomail
 + Origin: msg with different dest addr (1:106/2.0)
SEEN+BY: 106/2
PATH: 106/2


(Note: This is a normal routed netmail)
Pkt-Name:     55b7b82f.pkt
OrigAddr:     1:106/2.0
DestAddr:     1:19/10.0
pkt created:  Tue Jul 28 13:13:19 2015
pkt Password:
prodCode:     10ff
prodRevision  1.9
----------------------------------------
Msg: 106/2 -> 300/1
--Text----
INTL 1:300/1 1:106/2
MSGID: 1:106/2 55b7b830
PID: txt2pkt/fbsd 1.9.0-cur 25-05-15
TID: txt2pkt/fbsd 1.9.0-cur 25-05-15
Testing routed echomail
Via 1:106/2.0 @20150728.171319.UTC txt2pkt/fbsd 1.9.0-cur 25-05-15


Lets see what Squishmail thought of these messages:

+ 28 Jul 13:15:30 SQSH Begin, Squish v1.11 (mem=392K - main=02a2:0a87)
# 28 Jul 13:15:30 SQSH Tossing/scanning msgs from \Inbound (secure)
* 28 Jul 13:15:30 SQSH  55b7b7d8.Pkt, 07/28/15, 12:11:52, by ff 1.09
- 28 Jul 13:15:30 SQSH  Orig=1:106/2.0, Dest=1:19/10.0, Type=2+
: 28 Jul 13:15:30 SQSH    FIDONEWS       (Toss=0001  Sent=0001)
* 28 Jul 13:15:30 SQSH  55b7b819.Pkt, 07/28/15, 12:12:57, by ff 1.09
- 28 Jul 13:15:30 SQSH  Orig=1:106/2.0, Dest=1:19/10.0, Type=2+
: 28 Jul 13:15:30 SQSH    NETMAIL        (Toss=0001)
* 28 Jul 13:15:30 SQSH  55b7b80c.Pkt, 07/28/15, 12:12:44, by ff 1.09
- 28 Jul 13:15:30 SQSH  Orig=1:106/2.0, Dest=1:19/10.0, Type=2+
: 28 Jul 13:15:30 SQSH    NETMAIL        (Toss=0001)
* 28 Jul 13:15:30 SQSH  55b7b82f.Pkt, 07/28/15, 12:13:19, by ff 1.09
- 28 Jul 13:15:30 SQSH  Orig=1:106/2.0, Dest=1:19/10.0, Type=2+
: 28 Jul 13:15:30 SQSH    NETMAIL        (Toss=0001)
# 28 Jul 13:15:30 SQSH Scanning messages
# 28 Jul 13:15:30 SQSH Packing from \Msg\Net (3 msgs)
: 28 Jul 13:15:30 SQSH   Packed=3
+ 28 Jul 13:15:30 SQSH End.  Toss=4 (4/s), sent=4 (4/s), mem=224K

1.  The first message was tossed into the echo FIDONEWS and forwarded to
1:396/45, as it should.

2.  The second message from 1:106/2 in FIDONEWS was treated as routed echomail
and sent via 1:396/1

3.  The third message from 1:106/2 in OTHERECHO was treated as routed echomail
and sent via 1:396/1.

4.  The fourth message (netmail) was routed via 1:396/1 - as it should.

Some more detail from msgtrack.log (which is for logging routed NETMAIL!):

*** ECHOMAIL ***
Date: 28 Jul 15 13:15:30
From: Matt Bedynek                         (1:106/2)
  To: All                                  (1:100/1)
Subj:

*** ECHOMAIL ***
Date: 28 Jul 15 13:15:30
From: Matt Bedynek                         (1:106/2)
  To: All                                  (1:100/1)
Subj:

Date: 28 Jul 15 13:15:30
From: Matt Bedynek                         (1:106/2)
  To: All                                  (1:300/1)
Subj:

No only did squish route the echomails but it noted that they were echomail in
its netmail tracking log.

If you would like to validate the security of your node against this behavior
txt2pkt from husky project is good for the task.

Take care,

Matt

---
 * Origin: The Byte Museum - An IPV6 Capable System (1:19/10)