from-header-binding: findings of the technical and security reviews

Both reviews were of c171fb5, read-only, given the code and questions.

Found by both, and the one that would have refused ordinary mail from the
first day: a folded From: line - what a mail library makes of a long display
name - did not parse and was refused with 550. The line is unfolded before it
is read. e2e sends one through Postfix now.

Technical (Opus)
- A display name in a charset Go does not convert (windows-1251, koi8-r) was
  refused: such a name is passed through unread, only the address is judged.
- The statistics ran between binding the socket and serving it, with a
  supervisorctl that has no timeout: they are kept beside the check now and
  nothing of them is waited for. A supervisorctl that fails is logged.
- The count of deferred mail followed smtpd's reject lines and so missed a
  check that stops answering in the middle of a message, where cleanup
  writes them: it is taken at Postfix's warning, the line that names the
  socket. The test line for that case had been invented with the wrong
  process; it is marked as composed from Postfix's source.
- A card whose figures could not be read showed zeros and "ok": dashes and
  "unknown".
- entrypoint removes the sockets a killed container left, which satisfied
  the wrapper's wait before the check was listening.
- Outside quoted strings the line may hold one "@" only - a rule that needs
  no knowledge of OpenDKIM's parser.
- Comments that still spoke of two sockets, or of a session replaced after a
  refusal; the limits of the cards layout on a phone, said where it is defined.

Security (Fable; no Critical or High)
- Another sender's name in an encoded display name passed the second look:
  the decoded name is looked at as well.
- A client could arm the deferred counter by sending the socket's name where
  Postfix quotes it in a warning: the two warnings are matched from their
  first word.
- A refused message wrote a row per recipient: one row, naming the first
  recipient and how many more.
- Docs: the check's lookup is stricter than Postfix's for address extensions
  and the case of logins, rather than "cannot disagree"; what a display name
  looks like to a person is not promised; the timeouts and the 454 at AUTH
  stated as they are; "messages" are connections turned away.

Left as found, in the plan: downtime that crosses midnight is booked on the
day of the restart; a message with the null envelope sender leaves a row
without a domain; a log read again after an unclean stop counts again.

Test server, this tree: go vet ok, go test 23 packages ok, make e2e ok (330 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/logtail/sendercheck.go

@@ -13,7 +13,8 @@ import (
 // writes about it, and shown on Server > Health. It is the figure that also
 // sees a panel which is running and not answering.
 //
-// Postfix says it in lines of one smtpd process - why, then what:
+// Postfix says it in lines of one smtpd process - why, then what (seen on
+// the e2e stand, 2026-10-12):
 //
 //	postfix/smtpd[1183]: warning: connect to Milter service unix:/run/selfpost/sender.sock: No such file or directory
 //	postfix/smtpd[1183]: NOQUEUE: milter-reject: CONNECT from unknown[10.77.0.1]: 451 4.7.1 Service unavailable - try again later; proto=SMTP
@@ -24,10 +25,13 @@ import (
 // away, once: a client brings a message when it connects, and it will bring
 // it again.
 //
-// The reject lines do not name the milter, and the same words are written
-// when OpenDKIM does not answer or when the journal milter refuses under a
-// level-2 limit. So a process is remembered from the warning that names this
-// socket, and counted at its next reject line.
+// It is counted at the warning, which is the one line that names the socket.
+// The reject lines do not: the same words are written when OpenDKIM does not
+// answer and when the journal milter refuses under a level-2 limit, and for a
+// check that stops answering in the middle of a message they are written by
+// cleanup, another process, under a queue id. The warning for that case is
+// "milter unix:<socket>: can't read … reply packet header" (Postfix's
+// milter8.c; not seen on the stand).
 
 // SenderCheckStore is where the count goes. *store.Store satisfies it.
 type SenderCheckStore interface {
@@ -44,7 +48,6 @@ type SenderCheck struct {
 var smtpdLineRe = regexp.MustCompile(`^\S+ postfix/(?:[a-z0-9-]+/)?smtpd\[(\d+)\]: (.*)$`)
 
 const (
-	milterUnavailable = "Service unavailable - try again later"
 	// senderCheckPids bounds the processes remembered; smtpd processes are a
 	// few dozen, and a log that names more is not kept track of.
 	senderCheckPids = 1024
@@ -52,13 +55,20 @@ const (
 
 // deferredCounter is the per-run state of the count.
 type deferredCounter struct {
-	st     SenderCheckStore
-	needle string          // the socket as Postfix names it in a warning
-	failed map[string]bool // smtpd pid -> the check did not answer its current client
+	st SenderCheckStore
+	// The two warnings, up to and including the socket's name: nobody
+	// listening, and a reply that did not come.
+	connect, broken string
+	failed          map[string]bool // smtpd pid -> its current client was counted already
 }
 
 func newDeferredCounter(sc *SenderCheck) *deferredCounter {
-	return &deferredCounter{st: sc.Store, needle: "unix:" + sc.Socket, failed: make(map[string]bool)}
+	return &deferredCounter{
+		st:      sc.Store,
+		connect: "warning: connect to Milter service unix:" + sc.Socket + ":",
+		broken:  "warning: milter unix:" + sc.Socket + ":",
+		failed:  make(map[string]bool),
+	}
 }
 
 // handle looks at one mail.log line.
@@ -72,17 +82,18 @@ func (c *deferredCounter) handle(line string, now time.Time) {
 	switch {
 	case strings.HasPrefix(text, "connect from "):
 		delete(c.failed, pid)
-	case strings.HasPrefix(text, "warning: ") && strings.Contains(text, c.needle) && strings.Contains(strings.ToLower(text), "milter"):
-		// "connect to Milter service <socket>: …" when nobody listens, and
-		// "milter <socket>: can't read … reply packet header: …" when the
-		// check stopped answering in the middle of a message.
+	case strings.HasPrefix(text, c.connect) || strings.HasPrefix(text, c.broken):
+		// Postfix's own two sentences, from their first word: a warning also
+		// quotes what a client sent ("Illegal address syntax ... in MAIL
+		// command: <text>"), and a client can send the socket's name.
+		// Once for the connection, however many warnings it draws.
+		if c.failed[pid] {
+			return
+		}
 		if len(c.failed) >= senderCheckPids {
 			c.failed = make(map[string]bool)
 		}
 		c.failed[pid] = true
-	case c.failed[pid] && strings.Contains(text, "milter-reject: ") && strings.Contains(text, milterUnavailable):
-		// Once for the connection, however many commands the client tries.
-		delete(c.failed, pid)
 		if err := c.st.AddSenderCheckDeferred(at, 1); err != nil {
 			log.Printf("log-tailer: sender check statistics: %v", err)
 		}