mixandClaude Opus 5.5
89fd0a6116
test / test (push) Canceled after 0s
Both reviews were of c171fb5, read-only, given the code and questions.
Found by both, and the one that would have refused ordinary mail from the
first day: a folded From: line - what a mail library makes of a long display
name - did not parse and was refused with 550. The line is unfolded before it
is read. e2e sends one through Postfix now.
Technical (Opus)
- A display name in a charset Go does not convert (windows-1251, koi8-r) was
refused: such a name is passed through unread, only the address is judged.
- The statistics ran between binding the socket and serving it, with a
supervisorctl that has no timeout: they are kept beside the check now and
nothing of them is waited for. A supervisorctl that fails is logged.
- The count of deferred mail followed smtpd's reject lines and so missed a
check that stops answering in the middle of a message, where cleanup
writes them: it is taken at Postfix's warning, the line that names the
socket. The test line for that case had been invented with the wrong
process; it is marked as composed from Postfix's source.
- A card whose figures could not be read showed zeros and "ok": dashes and
"unknown".
- entrypoint removes the sockets a killed container left, which satisfied
the wrapper's wait before the check was listening.
- Outside quoted strings the line may hold one "@" only - a rule that needs
no knowledge of OpenDKIM's parser.
- Comments that still spoke of two sockets, or of a session replaced after a
refusal; the limits of the cards layout on a phone, said where it is defined.
Security (Fable; no Critical or High)
- Another sender's name in an encoded display name passed the second look:
the decoded name is looked at as well.
- A client could arm the deferred counter by sending the socket's name where
Postfix quotes it in a warning: the two warnings are matched from their
first word.
- A refused message wrote a row per recipient: one row, naming the first
recipient and how many more.
- Docs: the check's lookup is stricter than Postfix's for address extensions
and the case of logins, rather than "cannot disagree"; what a display name
looks like to a person is not promised; the timeouts and the 454 at AUTH
stated as they are; "messages" are connections turned away.
Left as found, in the plan: downtime that crosses midnight is booked on the
day of the restart; a message with the null envelope sender leaves a row
without a domain; a log read again after an unclean stop counts again.
Test server, this tree: go vet ok, go test 23 packages ok, make e2e ok (330 s).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
102 lines
3.8 KiB
Go
102 lines
3.8 KiB
Go
package logtail
|
|
|
|
import (
|
|
"log"
|
|
"regexp"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
// The sender check is attached to Postfix strictly: while the panel does not
|
|
// answer on its socket, mail is deferred (docs/plans/from-header-binding.md).
|
|
// How many submissions that happened to is read here, from what Postfix
|
|
// writes about it, and shown on Server > Health. It is the figure that also
|
|
// sees a panel which is running and not answering.
|
|
//
|
|
// Postfix says it in lines of one smtpd process - why, then what (seen on
|
|
// the e2e stand, 2026-10-12):
|
|
//
|
|
// postfix/smtpd[1183]: warning: connect to Milter service unix:/run/selfpost/sender.sock: No such file or directory
|
|
// postfix/smtpd[1183]: NOQUEUE: milter-reject: CONNECT from unknown[10.77.0.1]: 451 4.7.1 Service unavailable - try again later; proto=SMTP
|
|
// postfix/smtpd[1183]: NOQUEUE: milter-reject: EHLO from unknown[10.77.0.1]: 451 4.7.1 Service unavailable - try again later; proto=SMTP helo=<app>
|
|
//
|
|
// and the client, told "454 4.3.0 Try again later" at AUTH, goes away without
|
|
// a line of its own. So what is counted is the connection Postfix turned
|
|
// away, once: a client brings a message when it connects, and it will bring
|
|
// it again.
|
|
//
|
|
// It is counted at the warning, which is the one line that names the socket.
|
|
// The reject lines do not: the same words are written when OpenDKIM does not
|
|
// answer and when the journal milter refuses under a level-2 limit, and for a
|
|
// check that stops answering in the middle of a message they are written by
|
|
// cleanup, another process, under a queue id. The warning for that case is
|
|
// "milter unix:<socket>: can't read … reply packet header" (Postfix's
|
|
// milter8.c; not seen on the stand).
|
|
|
|
// SenderCheckStore is where the count goes. *store.Store satisfies it.
|
|
type SenderCheckStore interface {
|
|
AddSenderCheckDeferred(at time.Time, n int64) error
|
|
}
|
|
|
|
// SenderCheck turns the counting on: the store and the socket Postfix was
|
|
// given for the check (SENDER_CHECK_SOCKET), as a path.
|
|
type SenderCheck struct {
|
|
Store SenderCheckStore
|
|
Socket string
|
|
}
|
|
|
|
var smtpdLineRe = regexp.MustCompile(`^\S+ postfix/(?:[a-z0-9-]+/)?smtpd\[(\d+)\]: (.*)$`)
|
|
|
|
const (
|
|
// senderCheckPids bounds the processes remembered; smtpd processes are a
|
|
// few dozen, and a log that names more is not kept track of.
|
|
senderCheckPids = 1024
|
|
)
|
|
|
|
// deferredCounter is the per-run state of the count.
|
|
type deferredCounter struct {
|
|
st SenderCheckStore
|
|
// The two warnings, up to and including the socket's name: nobody
|
|
// listening, and a reply that did not come.
|
|
connect, broken string
|
|
failed map[string]bool // smtpd pid -> its current client was counted already
|
|
}
|
|
|
|
func newDeferredCounter(sc *SenderCheck) *deferredCounter {
|
|
return &deferredCounter{
|
|
st: sc.Store,
|
|
connect: "warning: connect to Milter service unix:" + sc.Socket + ":",
|
|
broken: "warning: milter unix:" + sc.Socket + ":",
|
|
failed: make(map[string]bool),
|
|
}
|
|
}
|
|
|
|
// handle looks at one mail.log line.
|
|
func (c *deferredCounter) handle(line string, now time.Time) {
|
|
at, rest := lineTime(line, now)
|
|
m := smtpdLineRe.FindStringSubmatch(rest)
|
|
if m == nil {
|
|
return
|
|
}
|
|
pid, text := m[1], m[2]
|
|
switch {
|
|
case strings.HasPrefix(text, "connect from "):
|
|
delete(c.failed, pid)
|
|
case strings.HasPrefix(text, c.connect) || strings.HasPrefix(text, c.broken):
|
|
// Postfix's own two sentences, from their first word: a warning also
|
|
// quotes what a client sent ("Illegal address syntax ... in MAIL
|
|
// command: <text>"), and a client can send the socket's name.
|
|
// Once for the connection, however many warnings it draws.
|
|
if c.failed[pid] {
|
|
return
|
|
}
|
|
if len(c.failed) >= senderCheckPids {
|
|
c.failed = make(map[string]bool)
|
|
}
|
|
c.failed[pid] = true
|
|
if err := c.st.AddSenderCheckDeferred(at, 1); err != nil {
|
|
log.Printf("log-tailer: sender check statistics: %v", err)
|
|
}
|
|
}
|
|
}
|