Subject: Re: Can you help with this?

From: Joseph S D Yao <[email-masked]>
Date: Wed, 20 Sep 2000 19:28:39 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Messed up the group mailing list address.  Here it is again.

On Wed, Sep 20, 2000 at 01:38:52PM -0700, Michael St. Laurent wrote:
> I sent this to the list but got no response.  I also noticed that the
amount
> of mail I get from the list has gone down a lot.  Since the problem I'm
> having is with smap I started to wonder if I was getting every message
that
> was sent.
> 
> Could you take a moment to look at this?
> 
> I've got fwtk 2.1 with the yao-smap patches running under SuSE Linux on
> Intel.  In the netperm-table I've specified the "smap: unknown-host 1"
> setting as well as the "broken-from" setting.  The logfile indicates
(unless
> I'm reading it wrong) that the connection is allowed but is dropped after
> the 10 minute timeout period expires.  Below is a snippet from the
logfile:
> 
> Sep 15 16:40:12 guardian smap[5150]: 207.204.245.3 host address lookup
> failed
> Sep 15 16:40:12 guardian smap[5150]: connect host=unknown/207.204.245.3
> Sep 15 16:50:12 guardian smap[5150]: Network timeout signal after 600
> seconds
> 
> A packet trace shows that the sending system connects, is sent the
greeting
> "220 guardian.hartwellcorp.com SMTP/smap Ready", it replies with a "HELO
> cadmail.cadnet.com" which is acknowledged by smap (with a TCP ACK) and
then
> nothing more happens on the wire til the timeout triggers and smap
> terminates the connection.  A "gdb" stack backtrace shows the following:
> 
> (gdb) bt
> #0  0x4008674e in ?? ()
> #1  0x400e87f5 in ?? ()
> #2  0x400ddef8 in ?? ()
> #3  0x805f54e in   ()
> #4  0x805f39e in gethostbyaddr ()
> #5  0x804c4d0 in hostmatch (pattern=0x8087e20
"localhost.hartwellcorp.com",
>     name=0x8086190 "207.204.245.3") at nama.c:363
> #6  0x804a64e in check_hostname ()
> #7  0x8048d1c in main ()
> (gdb)
> 
> The sender admits that their ISP will not allow/perform reverse DNS on the
> address (which is probably what is causing the problem).  Is there some
way
> to work around this?
> --------------------
> Michael St. Laurent
> Hartwell Corporation

I don't remember seeing this, so I will CC it to the list.

It looks like your DNS lookups are taking an unconscionably long time.
What is your DNS setup?

Ah!  It did appear - but was sandwiched between a lot of other things.
Perhaps now someone might come up with a better answer.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Rick Murphy <[email-masked]>
Date: Wed, 20 Sep 2000 22:48:12 -0400

>Perhaps now someone might come up with a better answer.

Ah! I've just had this problem!

I've got a long list of banned domains in my netperm-table. (I'm one of 
those anti-spam natzis here, I guess.) The problem with this happens when 
you've got a mail host that's trying to send to you with an invalid reverse 
DNS lookup. (Specifically when you try nslookup on their address and you 
see delay followed by 'server failed').
This triggers a long delay in smap - when a host connects, smap calls 
check_spamhost(); that routine reads each "smap: spam xxxxx" line in the 
netperma table and tries a match with the host address against those records.
If the netperm-table entry isn't a network address (1.1.3.* versus 
*.spammer.com), hostmatch must convert the passed-in address to a hostname 
in order to check if it matches. For broken DNS systems, this can take a 
VERY long time if you've got several name entires in your spam list.

I fixed this by adding a new routine to smap that front-ends hostmatch. 
Since smap already knows the IP and the hostname (or unknown), this new 
routine uses that already-known information to pass to hostmatch; then 
hostmatch doesn't have to do it's own reverse lookup.
         -Rick

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 21 Sep 2000 11:16:59 -0400

> hostmatch doesn't have to do it's own reverse lookup.

Oh, right!  I noticed that problem.  And I was going to do much the
same thing, but it involved re-writing a LOT of the code, the way I was
going to do it.  So it didn't get done.

Did you post your patch?

[@itm-inst.com???  Interesting.  Where is Evergreen Lane?]

---

From: Rick Murphy <[email-masked]>
Date: Thu, 21 Sep 2000 17:41:52 -0400

>going to do it.  So it didn't get done.

I put the change in last weekend.. I'd like to run this a bit longer before 
making it 'public'. My smap uses your patch with several tweaks here and 
there - RBL support, corrections for spam rejects (there are hosts that 
don't accept an error on the connect when you send 'em a 421 - they just 
immediately connect back, get the error, try again. Tens of thousands of 
rejects over a few hours.),   etc. You're welcome to the source if you're 
brave.

>[@itm-inst.com???  Interesting.  Where is Evergreen Lane?]

ITMI is my wife's company. Actually located on Annandale Rd in Annandale 
(inside the beltway.) The company pays for the DSL connection, I support 
the firewall.
         -Rick