Mark,

any views on this?

Regards,

Rob

-------- Original Message --------
Subject: Re: postfix-2.5.1 - smtpd logging
":unknown" on client lines
Date: Thu, 6 Mar 2008 00:18:32 -0500
From: Victor Duchovni <Victor.DuchovniMorganStanley.com>
Reply-To: postfix-userspostfix.org
To: postfix-userspostfix.org
References: <47CE8B5B.60605webtechnologygroup.co.uk>

On Wed, Mar 05, 2008 at 12:00:27PM +0000, Robert Brooks
wrote:

> is the ":unknown" here correct (2nd log
line)
> 
> Mar  5 08:51:19 mailhost postfix/smtpd[13095]: connect
from 
> localhost.localdomain[127.0.0.1]
> Mar  5 08:51:19 mailhost postfix/smtpd[13095]:
24A9318146: 
> client=mxpool12.ebay.com[66.135.197.18]:unknown
> 
> this is comes where a message comes back from a
pre-queue amavis 
> instance. I suspect it relates to the way xforward
commands interact 
> with postfix-2.5. I've looked at my logs from
postfix-2.4.6 and this 
> doesn't seem to be the case.
> 
> It seems to cause postfix-logwatch not to be able to
parse the entries, 
> not sure if this is a postfix-logwatch problem or
something postfix is 
> missing. What should be after the colon?

A source-port number. Amavis should ideally just proxy the
XFORWARD
data transparently letting Postfix talk to Postfix.

-- 
	Viktor.

Disclaimer: off-list followups get on-list replies or get
ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.
org/lists.html or click the link below:
<mailto:majordomopostfix.org?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me
is to not
send an "it worked, thanks" follow-up. If you must
respond, please put
"It worked, thanks" in the "Subject" so
I can delete these quickly.

-- 
Robert Brooks,            Network Manager,          Web
Technology Group
<robbwebtechnologygroup.co.uk>     http://www.webte
chnologygroup.co.uk/
Tel: +44 (0)20 7339 8600                        Fax: +44
(0)20 7339 8601

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Robert,

> > is the ":unknown" here correct (2nd log
line)
> >
> > Mar  5 08:51:19 mailhost postfix/smtpd[13095]:
connect from
> > localhost.localdomain[127.0.0.1]
> > Mar  5 08:51:19 mailhost postfix/smtpd[13095]:
24A9318146:
> > client=mxpool12.ebay.com[66.135.197.18]:unknown
> >
> > this is comes where a message comes back from a
pre-queue amavis
> > instance. I suspect it relates to the way xforward
commands interact
> > with postfix-2.5. I've looked at my logs from
postfix-2.4.6 and this
> > doesn't seem to be the case.
> >
> > It seems to cause postfix-logwatch not to be able
to parse the entries,
> > not sure if this is a postfix-logwatch problem or
something postfix is
> > missing. What should be after the colon?

My current code (to be released as 2.6.0) already supports
accepting and passing on the source port number through
XFORWARD
smtp extension command, so this will play well with Postfix
2.5
or later. Also the p0f interface will be happier with this
new
information.

Viktor writes:
> A source-port number. Amavis should ideally just proxy
the XFORWARD
> data transparently letting Postfix talk to Postfix.

amavisd is not a *transparent* proxy, it breaks such
expectations
on several accounts. It may come close enough to
transparency
so if one is not too picky, things may work. At reception
the
XFORWARD is parsed and attributes stored, and at forwarding
the
XFORWARD is reassembled from available data. It would not be
right
to accept any future attribute (such as PORT in this case)
not understanding what it does, and passing it back to MTA
not knowing if it will be accepted and what are its
effects.

  Mark


------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Robert Brooks wrote:
> Mark,
> 
> any views on this?
> 
> Regards,
> Rob
> 

Rob,

I have not seen the ":unknown" port in my logs nor
had others report 
this, so I suppose it is the less common pre-queue setup
that is the 
difference.

I'm about to update postfix-logwatch with some other
fixes/features.  If 
this is still an issue for you, I can provide a fix for
this.

btw. I just updated amavis-logwatch as well.

MrC

> -------- Original Message --------
> Subject: Re: postfix-2.5.1 - smtpd logging
":unknown" on client lines
> Date: Thu, 6 Mar 2008 00:18:32 -0500
> From: Victor Duchovni
> 
> On Wed, Mar 05, 2008 at 12:00:27PM +0000, Robert Brooks
wrote:
> 
>> is the ":unknown" here correct (2nd log
line)
>>
>> Mar  5 08:51:19 mailhost postfix/smtpd[13095]:
connect from 
>> localhost.localdomain[127.0.0.1]
>> Mar  5 08:51:19 mailhost postfix/smtpd[13095]:
24A9318146: 
>> client=mxpool12.ebay.com[66.135.197.18]:unknown
>>
>> this is comes where a message comes back from a
pre-queue amavis 
>> instance. I suspect it relates to the way xforward
commands interact 
>> with postfix-2.5. I've looked at my logs from
postfix-2.4.6 and this 
>> doesn't seem to be the case.
>>
>> It seems to cause postfix-logwatch not to be able
to parse the entries, 
>> not sure if this is a postfix-logwatch problem or
something postfix is 
>> missing. What should be after the colon?
> 
> A source-port number. Amavis should ideally just proxy
the XFORWARD
> data transparently letting Postfix talk to Postfix.
> 

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

MrC wrote:
> Robert Brooks wrote:
>> Mark,
>>
>> any views on this?
>>
>> Regards,
>> Rob
>>
> 
> Rob,
> 
> I have not seen the ":unknown" port in my
logs nor had others report 
> this, so I suppose it is the less common pre-queue
setup that is the 
> difference.

I always was the wierdo 

> I'm about to update postfix-logwatch with some other
fixes/features.  If 
> this is still an issue for you, I can provide a fix for
this.

it is, it appears with postfix-2.5 and amavis earlier than
2.6 that this 
information doesn't make it across in the xforward data
(after 2.6 you 
get a port number)

my unmatched entries look like this:

         1   Mar 19 05:14:25 ops postfix/smtpd[9421]:
B1C4B18292: 
client=mailer3.dailycandy.com[206.252.143.118]:unknown

         1   Mar 19 04:35:39 ops postfix/smtpd[9232]:
Anonymous TLS 
connection established from
mxpool12.ebay.com[66.135.197.18]: TLSv1 with 
cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)

> btw. I just updated amavis-logwatch as well.

excellent, thanks, I will pick that up.

Regards,

Rob

> MrC
> 
>> -------- Original Message --------
>> Subject: Re: postfix-2.5.1 - smtpd logging
":unknown" on client lines
>> Date: Thu, 6 Mar 2008 00:18:32 -0500
>> From: Victor Duchovni
>>
>> On Wed, Mar 05, 2008 at 12:00:27PM +0000, Robert
Brooks wrote:
>>
>>> is the ":unknown" here correct (2nd
log line)
>>>
>>> Mar  5 08:51:19 mailhost postfix/smtpd[13095]:
connect from 
>>> localhost.localdomain[127.0.0.1]
>>> Mar  5 08:51:19 mailhost postfix/smtpd[13095]:
24A9318146: 
>>>
client=mxpool12.ebay.com[66.135.197.18]:unknown
>>>
>>> this is comes where a message comes back from a
pre-queue amavis 
>>> instance. I suspect it relates to the way
xforward commands interact 
>>> with postfix-2.5. I've looked at my logs from
postfix-2.4.6 and this 
>>> doesn't seem to be the case.
>>>
>>> It seems to cause postfix-logwatch not to be
able to parse the 
>>> entries, not sure if this is a postfix-logwatch
problem or something 
>>> postfix is missing. What should be after the
colon?
>>
>> A source-port number. Amavis should ideally just
proxy the XFORWARD
>> data transparently letting Postfix talk to
Postfix.
>>


-- 
Robert Brooks,            Network Manager,          Web
Technology Group
<robbwebtechnologygroup.co.uk>     http://www.webte
chnologygroup.co.uk/
Tel: +44 (0)20 7339 8600                        Fax: +44
(0)20 7339 8601

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Robert Brooks wrote:
> MrC wrote:
>> Rob,
>>
>> I have not seen the ":unknown" port in my
logs nor had others report 
>> this, so I suppose it is the less common pre-queue
setup that is the 
>> difference.
> 
> I always was the wierdo 
> 
>> I'm about to update postfix-logwatch with some
other fixes/features.  
>> If this is still an issue for you, I can provide a
fix for this.
> 
> it is, it appears with postfix-2.5 and amavis earlier
than 2.6 that this 
> information doesn't make it across in the xforward data
(after 2.6 you 
> get a port number)
> 
> my unmatched entries look like this:
> 
>         1   Mar 19 05:14:25 ops postfix/smtpd[9421]:
B1C4B18292: 
> client=mailer3.dailycandy.com[206.252.143.118]:unknown
> 
>         1   Mar 19 04:35:39 ops postfix/smtpd[9232]:
Anonymous TLS 
> connection established from
mxpool12.ebay.com[66.135.197.18]: TLSv1 with 
> cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)

Thanks.  Patch to 1.36.13pre7 attached.  It will also be
included in the 
next (pre8) release.

MrC
> 
>> btw. I just updated amavis-logwatch as well.
> 
> excellent, thanks, I will pick that up.
> 
> Regards,
> 
> Rob

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/