dovecot - May 2006 - pop3 problem with small messages with no Subject: and no To: headers

Hello,
Seeing a strange thing with dovecot 1.0 b7 pop3.

If a user gets a particular _very_ short spam message (not sure what 
virus makes these..), with NO Subject and NO To: headers and NO body, 
(example available upon request), the user is unable to download the 
mail. The log entry is:

May 10 10:51:35 mail dovecot: POP3(user): Disconnected top=0/0, 
retr=1/1344, del=0/75, size=16383381

There's no QUIT, so no "Logged out" disconnect reason.
I did a tcpdump to see what was happening. I have not been able to 
duplicate this myself yet, even with an exact copy of the message that 
seems to be causing it, so it could be a client issue, but I've never 
seen this before, and we just switched to Dovecot, so I thought I'd 
check with the list.. ideas?

Message #9 is requested (it's the one in the user's box with missing 
headers). Dovecot begins returning it, but then disconnects, or so it seems.

10:51:35.171916 IP customer.60181 > mailserver.pop3: P 40:48(8) ack 1633 
win 65535
         0x0000:  4500 0030 d326 4000 7106 fc20 4624 16a1  E..0.&@.q...F$..
         0x0010:  ceaa 0f11 eb15 006e 7ee7 2a93 d845 fe0c  .......n~.*..E..
         0x0020:  5018 ffff 3618 0000 5245 5452 2039 0d0a  P...6...RETR.9..
10:51:35.172177 IP mailserver.pop3 > customer.60181: P 1633:2980(1347) 
ack 48 win 5840
         0x0000:  4500 056b ca0b 4000 4006 3101 ceaa 0f11  E..k.. at .@.1.....
         0x0010:  4624 16a1 006e eb15 d845 fe0c 7ee7 2a9b  F$...n...E..~.*.
         0x0020:  5018 16d0 3fde 0000 2b4f 4b20 3133 3237  P...?...+OK.1327
         0x0030:  206f 6374 6574 730d 0a52 6574 7572 6e2d  .octets..Return-
         0x0040:  5061 7468 3a20 3c68 7469 3935 6b67 6576  Path:.<hti95kgev
         0x0050:  4072                                     @r
10:51:35.416549 IP mailserver.pop3 > customer.60181: P 1633:2980(1347) 
ack 48 win 5840
         0x0000:  4500 056b ca0d 4000 4006 30ff ceaa 0f11  E..k.. at .@.0.....
         0x0010:  4624 16a1 006e eb15 d845 fe0c 7ee7 2a9b  F$...n...E..~.*.
         0x0020:  5018 16d0 3fde 0000 2b4f 4b20 3133 3237  P...?...+OK.1327
         0x0030:  206f 6374 6574 730d 0a52 6574 7572 6e2d  .octets..Return-
         0x0040:  5061 7468 3a20 3c68 7469 3935 6b67 6576  Path:.<hti95kgev
         0x0050:  4072                                     @r
10:51:35.470688 IP customer.60181 > mailserver.pop3: F 48:48(0) ack 2980 
win 64188
         0x0000:  4500 0028 d329 4000 7106 fc25 4624 16a1  E..(.)@.q..%F$..
         0x0010:  ceaa 0f11 eb15 006e 7ee7 2a9b d846 034f  .......n~.*..F.O
         0x0020:  5011 fabc 09fa 0000 0000 0000 0000       P.............
10:51:35.470997 IP mailserver.pop3 > customer.60181: F 2980:2980(0) ack 
49 win 5840
         0x0000:  4500 0028 ca0f 4000 4006 3640 ceaa 0f11  E..(.. at .@.6 at
....
         0x0010:  4624 16a1 006e eb15 d846 034f 7ee7 2a9c  F$...n...F.O~.*.
         0x0020:  5011 16d0 ede5 0000                      P.......
10:51:35.515279 IP customer.60181 > mailserver.pop3: . ack 2981 win 64188
         0x0000:  4500 0028 d32e 4000 7106 fc20 4624 16a1  E..(.. at .q...F$..
         0x0010:  ceaa 0f11 eb15 006e 7ee7 2a9c d846 0350  .......n~.*..F.P
         0x0020:  5010 fabc 09f9 0000 0000 0000 0000       P.............

That's all, the connection is closed.

Ken A
Pacific.Net

A followup..

This may be related to problems some email clients have with malformed 
headers. Emails that don't have a blank line at the end of the headers 
seem to cause problems for clients. Any one else deal with this issue?
For now, I'm just using SpamAssassin to kill them.

Ken A.
Pacific.Net

Ken A wrote:
> Hello,
> Seeing a strange thing with dovecot 1.0 b7 pop3.
> 
> If a user gets a particular _very_ short spam message (not sure what 
> virus makes these..), with NO Subject and NO To: headers and NO body, 
> (example available upon request), the user is unable to download the 
> mail. The log entry is:
> 
> May 10 10:51:35 mail dovecot: POP3(user): Disconnected top=0/0, 
> retr=1/1344, del=0/75, size=16383381
> 
> There's no QUIT, so no "Logged out" disconnect reason.
> I did a tcpdump to see what was happening. I have not been able to 
> duplicate this myself yet, even with an exact copy of the message that 
> seems to be causing it, so it could be a client issue, but I've never 
> seen this before, and we just switched to Dovecot, so I thought I'd 
> check with the list.. ideas?
> 
> Message #9 is requested (it's the one in the user's box with
missing
> headers). Dovecot begins returning it, but then disconnects, or so it 
> seems.
> 
> 10:51:35.171916 IP customer.60181 > mailserver.pop3: P 40:48(8) ack 1633
> win 65535
>         0x0000:  4500 0030 d326 4000 7106 fc20 4624 16a1 
E..0.&@.q...F$..
>         0x0010:  ceaa 0f11 eb15 006e 7ee7 2a93 d845 fe0c  .......n~.*..E..
>         0x0020:  5018 ffff 3618 0000 5245 5452 2039 0d0a  P...6...RETR.9..
> 10:51:35.172177 IP mailserver.pop3 > customer.60181: P 1633:2980(1347) 
> ack 48 win 5840
>         0x0000:  4500 056b ca0b 4000 4006 3101 ceaa 0f11  E..k.. at
.@.1.....
>         0x0010:  4624 16a1 006e eb15 d845 fe0c 7ee7 2a9b  F$...n...E..~.*.
>         0x0020:  5018 16d0 3fde 0000 2b4f 4b20 3133 3237  P...?...+OK.1327
>         0x0030:  206f 6374 6574 730d 0a52 6574 7572 6e2d  .octets..Return-
>         0x0040:  5061 7468 3a20 3c68 7469 3935 6b67 6576 
Path:.<hti95kgev
>         0x0050:  4072                                     @r
> 10:51:35.416549 IP mailserver.pop3 > customer.60181: P 1633:2980(1347) 
> ack 48 win 5840
>         0x0000:  4500 056b ca0d 4000 4006 30ff ceaa 0f11  E..k.. at
.@.0.....
>         0x0010:  4624 16a1 006e eb15 d845 fe0c 7ee7 2a9b  F$...n...E..~.*.
>         0x0020:  5018 16d0 3fde 0000 2b4f 4b20 3133 3237  P...?...+OK.1327
>         0x0030:  206f 6374 6574 730d 0a52 6574 7572 6e2d  .octets..Return-
>         0x0040:  5061 7468 3a20 3c68 7469 3935 6b67 6576 
Path:.<hti95kgev
>         0x0050:  4072                                     @r
> 10:51:35.470688 IP customer.60181 > mailserver.pop3: F 48:48(0) ack 2980
> win 64188
>         0x0000:  4500 0028 d329 4000 7106 fc25 4624 16a1  E..(.)@.q..%F$..
>         0x0010:  ceaa 0f11 eb15 006e 7ee7 2a9b d846 034f  .......n~.*..F.O
>         0x0020:  5011 fabc 09fa 0000 0000 0000 0000       P.............
> 10:51:35.470997 IP mailserver.pop3 > customer.60181: F 2980:2980(0) ack 
> 49 win 5840
>         0x0000:  4500 0028 ca0f 4000 4006 3640 ceaa 0f11  E..(.. at .@.6 at
....
>         0x0010:  4624 16a1 006e eb15 d846 034f 7ee7 2a9c  F$...n...F.O~.*.
>         0x0020:  5011 16d0 ede5 0000                      P.......
> 10:51:35.515279 IP customer.60181 > mailserver.pop3: . ack 2981 win
64188
>         0x0000:  4500 0028 d32e 4000 7106 fc20 4624 16a1  E..(.. at
.q...F$..
>         0x0010:  ceaa 0f11 eb15 006e 7ee7 2a9c d846 0350  .......n~.*..F.P
>         0x0020:  5010 fabc 09f9 0000 0000 0000 0000       P.............
> 
> That's all, the connection is closed.
> 
> Ken A
> Pacific.Net
> 
> 
> 
>