Opendmarc crashes with 'milter unix:/run/opendmarc/opendmarc.sock: can't read SMFIC_BODYEOB reply packet header: Application error'

[staszic01]

Find mail logs attached below:

Mar 25 20:58:31 boss postfix/smtpd[2285]: connect from list.uvm.edu[132.198.101.49]
Mar 25 20:58:33 boss policyd-spf[11415]: prepend Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=132.198.101.49; helo=list8.uvm.edu; envelope-from=owner-isogeochemslayoo**staszic-waw*-pl@list.uvm.edu; receiver=
Mar 25 20:58:33 boss postfix/smtpd[2285]: BB3DA2001614: client=list.uvm.edu[132.198.101.49]
Mar 25 20:58:34 boss postfix/cleanup[6363]: BB3DA2001614: message-id=1016af87-c017-053a-d9dc-4c4f43b0b73d@awi.de
Mar 25 20:58:34 boss opendkim[2525]: BB3DA2001614: list.uvm.edu [132.198.101.49] not internal
Mar 25 20:58:34 boss opendkim[2525]: BB3DA2001614: not authenticated
Mar 25 20:58:34 boss opendkim[2525]: BB3DA2001614: no signing domain match for 'awi.de'
Mar 25 20:58:34 boss opendkim[2525]: BB3DA2001614: no signing subdomain match for 'awi.de'
Mar 25 20:58:34 boss opendkim[2525]: BB3DA2001614: no signature data
Mar 25 20:58:34 boss postfix/cleanup[6363]: warning: milter unix:/run/opendmarc/opendmarc.sock: can't read SMFIC_BODYEOB reply packet header: Application error
Mar 25 20:58:34 boss postfix/cleanup[6363]: BB3DA2001614: milter-reject: END-OF-MESSAGE from list.uvm.edu[132.198.101.49]: 4.7.1 Service unavailable - try again later; from=owner-isogeochem*slayoo**STASZIC*-WAW*-PL@LIST.UVM.EDU to=slayoo@STASZIC.WAW.PL proto=ESMTP helo=<list8.uvm.edu>

In kernel log I found the following:
[35266.313292] opendmarc[19208]: segfault at 0 ip 0000148cd4fc76d0 sp 0000148cc7dd9138 error 4 in libbsd.so.0.11.3[148cd4fbf000+c000]

[glts]

What opendmarc version? Config? How to reproduce?

[staszic01]

What opendmarc version?

We currently use opendmarc version 1.4.1.1-r2

Config?

AuthservID boss.staszic.waw.pl
IgnoreAuthenticatedClients true
PidFile /var/run/opendmarc/opendmarc.pid
Socket local:/var/run/opendmarc/opendmarc.sock
UMask 0002
UserID opendmarc

Remaning values are set to its defaults

How to reproduce?

It crashes while processing email from list.uvm.edu. Unfortunately we haven't intercepted that email. Everything we know is attached in mail log above

[fbett]

I got today also such a message:

Postfix's milter log:

can't read SMFIC_BODYEOB reply packet header

Opendmarc (Version 1.4.0~beta1+dfsg-6+deb11u1) has logged:

failed to parse authentication-results: header field

This message was sent from xxx.outbound.protection.outlook.com.
The same error occurred on multiple attempts to deliver this email.

We temporary suspended the milter result in case of an error.
Using

"RejectFailures true"

did not bypass the problem.

[ronnybremer]

I am running into the same issue and from what I can see, it affects only certain senders (most of them seem to be using Exchange Online). Maybe it is caused by some of the headers Microsoft adds to the message or the double-DKIM signatures of outbound.protection.outlook.com?

[reubenfarrelly]

Ironically despite running Postfix, I'm seeing this in announce messages from the Postfix Announce mailing list:

Mar 9 16:41:10 tornado.reub.net postfix/cleanup[7072]: warning: milter inet:localhost:8893: can't read SMFIC_BODYEOB reply packet header: Application error
Mar 9 16:41:10 tornado.reub.net postfix/cleanup[7072]: 4PXJ2D5LCvz6xr6: milter-reject: END-OF-MESSAGE from list.sys4.de[2a03:4000:10:51d:b8ce:63ff:feca:a5a0]: 4.7.1 Service unavailable - try again later; from=postfix-announce-bounces@postfix.org to=reuben-postfix-announce@reub.net proto=ESMTP helo=<list.sys4.de>

And it dies like this:

Mar 9 16:41:10 tornado.reub.net kernel: opendmarc[7147]: segfault at 0 ip 00007fe74a4b44f0 sp 00007fe7492691b8 error 4 in libbsd.so.0.11.7[7fe74a4ac000+c000] likely on CPU 1 (core 0, socket 1)

It's killing opendmarc every time it tries to send a message to me which then causes all sorts of problems because with the milter dead - everything else then starts being deferred.

[fbett]

Possible fix #183

[thegushi]

Thank you for reporting this. The segfault inside libbsd.so during SMFIC_BODYEOB processing points to a NULL or corrupt pointer being dereferenced somewhere in opendmarc's end-of-message handling, but without a reproducer we can't trace it to the source.

If you still have the message (or even just its headers — From, ARC-*, Authentication-Results, Received) that triggered the crash, would you be able to share it? A minimal reproduction case would be very helpful.

Also worth noting: we've recently landed fixes for several ARC header parsing crashes in PR #296. If your crash was triggered by a message with ARC headers, testing against the fix/arcseal-crashes-183-222-236 branch may resolve it.