pgnd
commented
3 years ago @marcbradshaw
ping?
Closed pgnd closed 3 years ago
pgnd
commented
3 years ago @marcbradshaw
ping?
marcbradshaw
commented
3 years ago Thanks for the ping @pgnd
There are a few issues here..
The first is a bug, Term is mis-cased in the signal name, so the shutdown isn't happening. I'll fix that.
The second is that IPRev Handler requires the Auth handler to be loaded so it can exclude any authenticated connections from that check. An improvement would be to only do that check IF the Auth handler is loaded, so I will make that change. For now, enabling the Auth handler should fix the problem. Could you do that and let me know how it goes.
The third is, ERROR: DMARC Error Can't call method "binip" on an undefined value, which I shall investigate.
pgnd
commented
3 years ago @marcbradshaw
The first is a bug, Term is mis-cased in the signal name, so the shutdown isn't happening. I'll fix that.
+1
enabling the Auth handler should fix the problem. Could you do that and let me know how it goes.
changing
"IPRev" : {},
- "!Auth" : {},
+ "Auth" : {}+@ launch,
systemctl start fm-auth-milterlogs,
journalctl -f -u fm-auth-milter
-- Logs begin at Wed 2020-10-21 08:26:01 PDT. --
Oct 21 15:31:42 srv016 authentication_milter_mx[14753]: Setting uid to "1008"
Oct 21 15:31:42 srv016 authentication_milter_mx[14753]: DMARC Preloaded PSL
Oct 21 15:31:42 srv016 authentication_milter_mx[14753]: Warning: The Auth handler only works with the milter protocol at /usr/local/share/perl5/5.30/Mail/Milter/Authentication/Handler/Auth.pm line 31.<LF>
Oct 21 15:31:43 srv016 authentication_milter_mx[14768]: Child process 14768 starting up
Oct 21 15:32:43 srv016 authentication_milter_mx[14772]: Dequeue process 14772 starting up
Oct 21 15:32:43 srv016 authentication_milter_mx[14772]: DEQUEUE.7AD89DDB98A: Dequeue process 14772 shutting down
Oct 21 15:33:43 srv016 authentication_milter_mx[14773]: Dequeue process 14773 starting up
Oct 21 15:33:43 srv016 authentication_milter_mx[14773]: DEQUEUE.15B5BF54B4E: Dequeue process 14773 shutting down
...no FATAL errors.
just the WARNING. which caused a bit of confusion ... that WARNING is why it was DISabled, as I'm in 'smtpd' mode.
ERROR: DMARC Error Can't call method "binip" on an undefined value, which I shall investigate.
+1
marcbradshaw
commented
3 years ago @pgnd Can you confirm what is at /usr/share/perl5/vendor_perl/Net/IP.pm line 761 for your install. For my 5.30.1 install this is somewhere within the overlaps method, which is called from the DMARC module, but only if there are whitelist entries, and those were not present in your supplied config. I couldn't reproduce the issue with similar config, can you enable debugging in the config and send through the debugging log of a message triggering the DMARC error.
pgnd
commented
3 years ago @marcbradshaw
Can you confirm what is at /usr/share/perl5/vendor_perl/Net/IP.pm line 761
here,
perl -v
This is perl 5, version 30, subversion 3 (v5.30.3) built for x86_64-linux-thread-multi
cat /usr/share/perl5/vendor_perl/Net/IP.pm
...
#------------------------------------------------------------------------------
# Subroutine overlaps
# Purpose : Check if two prefixes overlap
# Params : Prefix to compare
# Returns : $NO_OVERLAP (no overlap)
# $IP_PARTIAL_OVERLAP (overlap)
# $IP_A_IN_B_OVERLAP (range1 is included in range2)
# $IP_B_IN_A_OVERLAP (range2 is included in range1)
# $IP_IDENTICAL (range1 == range2)
# or undef (problem)
sub overlaps {
my ($self, $other) = @_;
761 my $r = ip_is_overlap(
$self->binip(), $self->last_bin(),
$other->binip(), $other->last_bin()
);
if (!defined($r)) {
$self->{error} = $ERROR;
$self->{errno} = $ERRNO;
return;
}
return ($r);
}
#------------------------------------------------------------------------------
# Subroutine auth
...edit
authentication_milter.json
- "debug" : 0,
+ "debug" : 1,received message headers,
...
Authentication-Results: auth-milter.mx.example.net;
dkim=pass (2048-bit rsa key sha256) header.d=gmail.com
header.i=@gmail.com header.b=Zjew3QPs header.a=rsa-sha256
header.s=20161025;
!! dmarc=temperror header.from=gmail.com;
iprev=pass smtp.remote-ip=209.85.215.176 (mail-pg1-f176.google.com);
spf=pass smtp.mailfrom=###user@gmail.com
smtp.helo=mail-pg1-f176.google.com;
x-ptr=pass smtp.helo=mail-pg1-f176.google.com
policy.ptr=mail-pg1-f176.google.com;
x-return-mx=pass header.domain=gmail.com policy.is_org=yes
(MX Records found: alt4.gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com,alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com);
x-return-mx=pass smtp.domain=gmail.com policy.is_org=yes
(MX Records found: alt4.gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com,alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com)
...debug log ==> https://pastebin.com/eXjNQTL7
marcbradshaw
commented
3 years ago Thanks, I still can't see why overlaps would be called in the DMARC handler, as you do not have a whitelist. The 20201022 branch adds some extra checking around those calls to make the IP object is valid, are you able to build from that branch and see if this fixes the issue? It will at least rule this section of the code out as the problem.
pgnd
commented
3 years ago this^ is
cpanp -i Mail::Milter::Authenticationinstalled ...
I'll get a build figured out and give it a whirl.
Sailfish33
commented
3 years ago branch and Take me off
On Thu, Oct 22, 2020 at 00:31 Magnus Nilsson mnilsson701@gmail.com wrote:
On Thu, Oct 22, 2020 at 00:30 pgnd notifications@github.com wrote:
this^ is
cpanp -i Mail::Milter::Authentication
installed ...
I'll get a build figured out and give it a whirl.
— You are receiving this because you are subscribed to this thread.take me off
Reply to this email directly, view it on GitHub https://github.com/fastmail/authentication_milter/issues/85#issuecomment-714216911, or unsubscribe https://github.com/notifications/unsubscribe-auth/AFNUPTE24E5LYCB43WQNQ2DSL6YO7ANCNFSM4SFG6O3A .
Sailfish33
commented
3 years ago Like now
On Thu, Oct 22, 2020 at 00:31 Magnus Nilsson mnilsson701@gmail.com wrote:
branch and Take me off
On Thu, Oct 22, 2020 at 00:31 Magnus Nilsson mnilsson701@gmail.com wrote:
On Thu, Oct 22, 2020 at 00:30 pgnd notifications@github.com wrote:
this^ is
cpanp -i Mail::Milter::Authentication
installed ...
I'll get a build figured out and give it a whirl.
— You are receiving this because you are subscribed to this thread.take me off
Reply to this email directly, view it on GitHub https://github.com/fastmail/authentication_milter/issues/85#issuecomment-714216911, or unsubscribe https://github.com/notifications/unsubscribe-auth/AFNUPTE24E5LYCB43WQNQ2DSL6YO7ANCNFSM4SFG6O3A .
marcbradshaw
commented
3 years ago @Sailfish33 You subscribed to this repo on github which if why you are receiving notification emails, you'll need to unsubscribe yourself. We can't do it for you. You can use the link in the email.
pgnd
commented
3 years ago @Sailfish33
Like now
You're logged into github, subscribed to this repo, you've posted an unsubscribe link ... and you don't use it, and instead spam multiple threads @ GH?
::facepalm::
pgnd
commented
3 years ago @marcbradshaw
The 20201022 branch adds some extra checking around those calls to make the IP object is valid, are you able to build from that branch and see if this fixes the issue?
it builds, but fails 'make test.
git checkout 20201022
perl Makefile.PL
make V=1real issues, or red herring?
pgnd
commented
3 years ago after cleaning house ... rm'ing all traces of the install, and re-build/installed via latest cpan, 20200930
of course, now it 'works' without the temperror. or any other errors in debug log.
sigh.
marcbradshaw
commented
3 years ago Cool I guess, I will close this, but if you are able to reproduce please re-open.
pgnd
commented
3 years ago @marcbradshaw
good news, bad news. it ain't misbehavin'.
but yep, I'll reopen if/when I find something.
i've set up authentication-milter in smtp mode
with this config,
on launch of the milter service,
i get a FATAL error,
and then the process runs away, spewing endlessly
& requiring a service kill to exit.
toggling to DISABLE IPRev
eliminates the runaway, launch is successful, but on mail receipt -- from Fastmail servers -- logs report,