Bug#478470: ca-certificates update breaks Exim4/etch client doing TLS with Exim4/testing

[Jonathan McDowell]

Package: exim4
Version: 4.69-4

I started seeing the "A TLS packet with unexpected length was received."
error yesterday, with connections from a box running Etch (exim4
4.63-17) and using the box running testing as an SMTP relay with auth
over TLS. At the time I was running 4.69-2+b1 but I've since upgraded to
4.69-4 in case that resolved it - it didn't.

Looking at /var/log/dpkg.log for packages that where upgraded on
27th/28th (in particular I was looking for gnutls related things) the
only potential candidate was ca-certificates, which I upgraded from
20070303-0.1 to 20080411 on the 27th. I "aptitude purge ca-certificates"
and tried flushing the queue on the stable box; mail started flowing
again.

If I install ca-certificates 20070303-0.1 mail flows correctly. If I
upgrade to 20080411 Exim starts logging the TLS error again.

I'm not using client certificates; auth is done by username/password.

-- Package-specific info:
Exim version 4.69 #1 built 27-Apr-2008 09:13:52
Copyright (c) University of Cambridge 2006
Berkeley DB: Berkeley DB 4.6.21: (September 27, 2007)
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc GnuTLS move_frozen_messages Content_Scanning Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql sqlite
Authenticators: cram_md5 cyrus_sasl dovecot plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
Configuration file is /var/lib/exim4/config.autogenerated
# /etc/exim4/update-exim4.conf.conf
#
# Edit this file and /etc/mailname by hand and execute update-exim4.conf
# yourself or use 'dpkg-reconfigure exim4-config'
#
# Please note that this is _not_ a dpkg-conffile and that automatic changes
# to this file might happen. The code handling this will honor your local
# changes, so this is usually fine, but will break local schemes that mess
# around with multiple versions of the file.
#
# update-exim4.conf uses this file to determine variable values to generate
# exim configuration macros for the configuration file.
#
# Most settings found in here do have corresponding questions in the
# Debconf configuration, but not all of them.
#
# This is a Debian specific file

dc_eximconfig_configtype='internet'
dc_other_hostnames='tangerine.org.uk'
dc_local_interfaces=''
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname=''
dc_mailname_in_oh='true'
dc_localdelivery='maildir_home'
mailname:limegreen.tangerine.org.uk

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.18-6-xen-amd64 (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages exim4 depends on:
ii  debconf [debconf-2.0]         1.5.20     Debian configuration management sy
ii  exim4-base                    4.69-4     support files for all Exim MTA (v4
ii  exim4-daemon-heavy            4.69-4     Exim MTA (v4) daemon with extended

exim4 recommends no packages.

-- debconf information:
  exim4/drec: