Re: Beware: smtp_proxy_filter

From: Victor Duchovni (no email)
Date: Fri Jul 01 2005 - 23:51:19 EDT

  • Next message: Ralf Hildebrandt: "Re: Content Filter position in main.cf"

    On Sat, Jul 02, 2005 at 02:20:23AM +0400, Michael Tokarev wrote:

    > When there's a pre-queue content filter configured in
    > Postfix smtpd (smtpd_proxy_filter), and that filter is
    > catching DATA command to perform content checks, saving
    > the incoming message in a temp file, this filter, at
    > least in current architecture, is responsible to enforce
    > (initial) message_size_limit by its own.
    >

    This is fixed in the the latest 2.3 snapshot for clients that use ESMTP.
    If the client honours the 250-SIZE=... EHLO reponse, it will not send
    oversize messages. Some clients ignore the size limit, but send the real
    size with "MAIL FROM:<addr> SIZE=..." here with 2.3 the pre-filter smtpd
    will now reject mail from if the size is too large.

    So we are left with clients that lie (deliberate attack) or clients that
    don't do ESMTP. Note that Postfix will always send EHLO to the filter,
    even if the external client is using plain SMTP, so the proxy filter
    gets to see the post-filter 250-SIZE=... response. This gives it the
    opportunity to not exceed the advertised size limit as it buffers up
    the message body (any filter that modifies the top-level header after
    inspecting the entire message needs to buffer as much of the message
    as it needs to inspect before it can send the header downstream).

    So yes, the filter owns enforcing the limit for either clients that
    lie or clients that don't talk ESMTP, fortunately it is given the
    necessary information in the EHLO response from the post-filter
    server.

    -- 
    	Viktor.
    Disclaimer: off-list followups get on-list replies or get ignored.
    Please do not ignore the "Reply-To" header.
    To unsubscribe from the postfix-users list, visit
    http://www.postfix.org/lists.html or click the link below:
    <mailto:?body=unsubscribe%20postfix-users>
    

  • Next message: Ralf Hildebrandt: "Re: Content Filter position in main.cf"





    Hosted Email Solutions

    Invaluement Anti-Spam DNSBLs



    Powered By FreeBSD   Powered By FreeBSD