Alert Preference - Email notification issues

[JoSmittyCan]

I setup AiProtection and tested the Malicious Sites Blocking feature. I found that it works fine at blocking, but I never receive the alert emails.

For test, I used a website that is known to be a scamming site ("elongives[dot]org") and Tread Micro does indeed block it as expected (I get the Trend Micro "Dangerous Page" error). Note that Microsoft Edges blocks it too, but you can click on "Continue to the unsafe site (not recommended)" and then Trend Micro blocks it.

Looking at the Router's web page, I see the count increasing (confirming it did block the page), but I never receive the alert email.

For the Alert Preferences, I created a dedicated Gmail account, with 2FA and created an application password which I then used to configure the router email settings. Immediately after setting up the email parameters in the router, I received a confirmation email in my Gmail account : "This is for your mail address confirmation and please click below link to go back firmware page for configuration". So this confirmed the router could successfully use the email account settings (email and password) to send an email.

So I thought everything was ready. But for some reason, no actual alert email ever go through. I tried multiple times accessing that scamming website, saw the router counter increase, but no email. I checked in the Gmail spam folder, no email is coming in.

I also tried rebooting the router (accessing the bad website again, etc.), and that didn't help either.

I have the RT-AX5400 with latest (stock) firmware (version 3.0.0.4.388_23785).

Is it possible the emails are only sent once a day or hours later?

Any help is welcome ...

Jo S.

 

[JoSmittyCan]

I found this post (here) from @HarryMuscle explaining the problem, which would be related to some nvram variable.

To test it, I connected to my router with ssh and queried the PM_SMTP_AUTH_USER variable. And as predicted, it's missing the @gmail.com part.

For example, assuming my Gmail address is your.email@gmail.com, here's what I get :

>nvram get PM_SMTP_AUTH_USER​

>your.email​

Based on @HarryMuscle, this would be an Asus firmware GUI bug and the solution is to modify the variable stored in nvram like this :

nvram set PM_SMTP_AUTH_USER=your.email@gmail.com
nvram commit

Is it something that is safe to do on stock firmware, can it break something?
Could it be overwritten at the next reboot or while browsing in the GUI?

Jo S.

P.S.: Difficult to believe this really is a bug, because it would suggest that the alert email feature doesn't work for anyone with a gmail address (except through SSH hacking), which would raise questions about Asus' QA process.

 

[JoSmittyCan]

Ok, I looked at the code on Github (here -- the Merlin's code, because I can't find Asuswrt stock source code). And the problem seems to be with the AiProtection_HomeProtection.asp file, in function apply_alert_preference().

When the code builds the form for the Google SMTP server authentication, it gets everything right, except for the username where it clearly forgets about the "@gmail.com" part:

var account_temp = document.getElementById('mail_address').value.split("@");
/* ... skipped many lines  ... */
document.form.PM_SMTP_AUTH_USER.value = account_temp[0];
document.form.PM_SMTP_AUTH_PASS.value = document.getElementById('mail_password').value;
document.form.PM_SMTP_SERVER.value = smtpList[server_index].smtpServer;
document.form.PM_SMTP_PORT.value = smtpList[server_index].smtpPort;

We see in the code that the authentification username is set to account_temp[0], which is only the first part of the email address, i.e. before '@gmail.com'. It's account_temp[1] that contains the "gmail.com" part.

When authenticating with Google's SMTP server, the username must be the full Gmail address, including the @gmail.com part, which is (most probably) why this code doesn't work.

I wonder if some firmware versions got this right or if all versions have the same problem ...

Jo S.

 

[JoSmittyCan]

I see the asp file is stored in the /www folder on the router (here: /www/AiProtection_HomeProtection.asp).

We need to change that line :

document.form.PM_SMTP_AUTH_USER.value = account_temp[0];

for that line :

document.form.PM_SMTP_AUTH_USER.value = account_temp[0] + "@" +smtpList[server_index].smtpDomain;

Jo S.