Subject: RE: smap/smapd/postfix: malformed sender addesses

From: "Randal, Phil" <[email-masked]>
Date: Wed, 23 Aug 2000 10:40:36 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I've just discovered this one for myself (a few months late).
Exchange creates SMTP from: strings of the form

  "From: <[email-masked]> SIZE=9999"

Dodgy in the least...  But the fix is to patch SMAP to terminate
the From: string at the trailing space.

In the main loop in smap.c, the code should look like this:

			/* Skip over "from:" and any spaces. */
			q += 5;
			while(isspace(*q))
				q++;
+			
+			/* Terminate string at first space to clean up
+			   MS Exchange "From: <user@domain> SIZE=nnn"
+			   nonsense - pr 20000821 */
+
+			tmpstr = strchr(q,' ');
+			if (tmpstr != (char *)NULL)
+			  *tmpstr = '\0';

			/*
			** If we already had an ruser ["should never
			** happen"], free the staorage space.
			*/
			if(ruser != (char *)0)
				free(ruser);

I'd post a proper diff, but my SMAP is V2.1 + YAO + assorted
patches.

Phil
------------------------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council, UK

> -----Original Message-----
> From: Overdijk, Harrie [mailto:[email-masked]]
> Sent: 07 June 2000 13:35
> To: [email-masked]
> Subject: smap/smapd/postfix: malformed sender addesses
> 
> 
> [To be removed from this list send the message "unsubscribe 
> fwtk-users" in the
> BODY of a mail message to [email-masked].]
> 
> Dear FWTK-guru's
> 
> The time has come to get rid of ouw good old mail-gateway
> and replace it by a system running the smap/smapd combo from
> fwtk 2.1 with the Joseph Yao Antirelay/AntiSPAM patches. As
> a replacement for sendmail I have chosen for postfix in send
> only mode and configured it for use on a firewall. I have
> tested it local from several systems using telnet to simulate
> a SMTP session and all looks well.
> 
> So the time has come to let our Microsoft Exchange server
> version 5.5 send the messages via the described system to
> the outside world. I was very scared when I saw the
> following type of messages in the log:
> 
>  -----8<-----
> Jun  7 13:26:10 ecnwall postfix/sendmail[2427]: warning: -f 
> option specified
> malformed sender: <[email-masked]> SIZE=1639
>  -----8<-----
> 
> That does not look good... especially not when I saw:
> 
>  -----8<-----
> Jun  7 13:26:11 ecnwall postfix/pickup[2149]: 0B0DD2F: uid=5
> from=<SIZE=1639>
> Jun  7 13:26:11 ecnwall postfix/cleanup[2425]: 0B0DD2F:
> message-id=<[email-masked]>
> Jun  7 13:26:11 ecnwall postfix/qmgr[1738]: 0B0DD2F:
> from=<SIZE=[email-masked]>, size=1979 (queue active)
>  -----8<-----
> 
> The 'sender' address has become <SIZE=1639@blabla> instead of
> <[email-masked]>. Most messages were accepted by the remote
> system, but I don't feel good about it. I think there are
> remote systems that will not accept these types of sender
> addresses... So... I switched back to the old mailgateway
> and wait for a response on my following question:
> 
> Has anyone seen this before? And (even better) has anyone a
> patch to fight this type of Gatesware functionallity?
> 
> Thanks in advance for your help!
> 
> Harrie.
> 
> Harrie Overdijk, ECN, Postbox 1, 1755 ZG  Petten (NH), The 
> Netherlands.
> Internet: [email-masked]              Noisenet: +31 224 56 4597
> Fidonet : 2:500/43.1902  (At home!)    FAXnet  : +31 224 56 1864
> ICP/Postmaster/UseNet-News-manager/WWW-manager/Security-manage
> r of ECN.
>