Loading ...
Sorry, an error occurred while loading the content.
 

"can't read SMFIC_RCPT reply packet header" errors with large attachments

Expand Messages
  • Quanah Gibson-Mount
    Note: postfix 2.7.10 release A number of customers are noting that they are getting the following error when using a milter: Jun 26 20:18:10 zmail
    Message 1 of 4 , Jul 12, 2013
      Note: postfix 2.7.10 release

      A number of customers are noting that they are getting the following error
      when using a milter:

      Jun 26 20:18:10 zmail postfix/smtpd[11438]: connect from
      server.domain.com[1.2.3.4]
      Jun 26 20:18:10 zmail postfix/smtpd[32729]: NOQUEUE: filter: RCPT from
      server.domain.com[1.2.3.4]: <bounce-2596705-20907522@...>:
      Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026;
      from=<bounce-2596705-20907522@...> to=<user@...>
      proto=ESMTP helo=<server.domain.com>
      Jun 26 20:18:10 zmail postfix/smtpd[32729]: warning: milter
      inet:127.0.0.1:7026: can't read SMFIC_RCPT reply packet header: Success
      Jun 26 20:18:10 zmail postfix/smtpd[32729]: NOQUEUE: milter-reject: RCPT
      from
      server.domain.com[1.2.3.4]: 451 4.7.1 Service unavailable - try again later;
      from=<bounce-2596705-20907522@...> to=<user@...>
      proto=ESMTP helo=<server.domain.com>
      Jun 26 20:18:10 zmail postfix/smtpd[32729]: lost connection after RCPT from
      server.domain.com[1.2.3.4]
      Jun 26 20:18:10 zmail postfix/smtpd[32729]: disconnect from
      server.domain.com[1.2.3.4]

      So far, we've tried increasing timeouts for the milter via:

      milter_connect_timeout
      milter_command_timeout
      milter_content_timeout

      But even for very large values, we are still seeing the problem occur.
      Setting milter_default_action=accept stops the error messages, but then
      bypasses the milter for these messages, somewhat defeating the purpose of
      the milter. ;)

      Any hints on what else we can look at?


      Thanks,
      Quanah

      --

      Quanah Gibson-Mount
      Sr. Member of Technical Staff
      Zimbra, Inc
      A Division of VMware, Inc.
      --------------------
      Zimbra :: the leader in open source messaging and collaboration
    • Wietse Venema
      ... Note that this is logged within the same second, so changing the POSTFIX milter_xxx_timeout settings has no effect. Have you considered changing the
      Message 2 of 4 , Jul 12, 2013
        Quanah Gibson-Mount:
        >
        > Note: postfix 2.7.10 release
        >
        > A number of customers are noting that they are getting the following error
        > when using a milter:
        >
        > Jun 26 20:18:10 zmail postfix/smtpd[32729]: NOQUEUE: filter: RCPT from
        > server.domain.com[1.2.3.4]: <bounce-2596705-20907522@...>:
        > Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026;
        > from=<bounce-2596705-20907522@...> to=<user@...>
        > proto=ESMTP helo=<server.domain.com>
        > Jun 26 20:18:10 zmail postfix/smtpd[32729]: warning: milter
        > inet:127.0.0.1:7026: can't read SMFIC_RCPT reply packet header: Success

        Note that this is logged within the same second, so changing the
        POSTFIX milter_xxx_timeout settings has no effect.

        Have you considered changing the timeout settings on the MILTER end?

        It is possible that the Milter times out when requests from Postfix
        are too far apart in time. The Postfix SMTP server has a 300s time
        limit for client commands (reduced to 10s under overload). The Milter
        time limit may be less.

        The error message comes from this Postfix code fragment:

        /*
        * Receive the packet length.
        */
        if ((vstream_fread(milter->fp, (char *) &len, UINT32_SIZE))
        != UINT32_SIZE) {
        smfic_name = str_name_code(smfic_table, event);
        msg_warn("milter %s: can't read %s reply packet header: %m",
        milter->m.name, smfic_name != 0 ?
        smfic_name : "(unknown MTA event)");

        If you monitor the postfix-to-Milter communication with a network
        sniffer, then you will see that the Milter closes the connection
        without sending the SMFIC_RCPT reply to Postfix.

        Wietse
      • Quanah Gibson-Mount
        --On Friday, July 12, 2013 4:10 PM -0400 Wietse Venema ... Ok, thanks! We ve tried bumping up the milter timeout as well, but perhaps it wasn t high enough.
        Message 3 of 4 , Jul 12, 2013
          --On Friday, July 12, 2013 4:10 PM -0400 Wietse Venema
          <wietse@...> wrote:

          > Quanah Gibson-Mount:
          >>
          >> Note: postfix 2.7.10 release
          >>
          >> A number of customers are noting that they are getting the following
          >> error when using a milter:
          >>
          >> Jun 26 20:18:10 zmail postfix/smtpd[32729]: NOQUEUE: filter: RCPT from
          >> server.domain.com[1.2.3.4]: <bounce-2596705-20907522@...>:
          >> Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026;
          >> from=<bounce-2596705-20907522@...> to=<user@...>
          >> proto=ESMTP helo=<server.domain.com>
          >> Jun 26 20:18:10 zmail postfix/smtpd[32729]: warning: milter
          >> inet:127.0.0.1:7026: can't read SMFIC_RCPT reply packet header: Success
          >
          > Note that this is logged within the same second, so changing the
          > POSTFIX milter_xxx_timeout settings has no effect.
          >
          > Have you considered changing the timeout settings on the MILTER end?
          >
          > It is possible that the Milter times out when requests from Postfix
          > are too far apart in time. The Postfix SMTP server has a 300s time
          > limit for client commands (reduced to 10s under overload). The Milter
          > time limit may be less.
          >
          > The error message comes from this Postfix code fragment:
          >
          > /*
          > * Receive the packet length.
          > */
          > if ((vstream_fread(milter->fp, (char *) &len, UINT32_SIZE))
          > != UINT32_SIZE) {
          > smfic_name = str_name_code(smfic_table, event);
          > msg_warn("milter %s: can't read %s reply packet header: %m",
          > milter->m.name, smfic_name != 0 ?
          > smfic_name : "(unknown MTA event)");
          >
          > If you monitor the postfix-to-Milter communication with a network
          > sniffer, then you will see that the Milter closes the connection
          > without sending the SMFIC_RCPT reply to Postfix.

          Ok, thanks! We've tried bumping up the milter timeout as well, but perhaps
          it wasn't high enough. I will work some more on this with the client.


          --Quanah


          --

          Quanah Gibson-Mount
          Sr. Member of Technical Staff
          Zimbra, Inc
          A Division of VMware, Inc.
          --------------------
          Zimbra :: the leader in open source messaging and collaboration
        • Wietse Venema
          ... Consider using MILTER time limits = Postfix time limits. Setting them to a shorter value is a mistake. Wietse
          Message 4 of 4 , Jul 12, 2013
            Quanah Gibson-Mount:
            > > It is possible that the Milter times out when requests from Postfix
            > > are too far apart in time. The Postfix SMTP server has a 300s time
            > > limit for client commands (reduced to 10s under overload). The Milter
            > > time limit may be less.
            ...
            > Ok, thanks! We've tried bumping up the milter timeout as well, but perhaps
            > it wasn't high enough. I will work some more on this with the client.

            Consider using MILTER time limits >= Postfix time limits. Setting
            them to a shorter value is a mistake.

            Wietse
          Your message has been successfully submitted and would be delivered to recipients shortly.