OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: FW: Error in SMTP sequence

From: Wietse Venema (wietseporcupine.org)
Date: Wed Apr 18 2007 - 05:58:35 CDT


Rob Sterenborg:
> >>> If your sniffer confirms that no "RCPT TO:" is sent, then perhaps
> >>> the cause is a buggy PIPELINING implementation on the sending side.
> >
> > Yes, when I used tcpdump to check (a while ago; don't have
> > the dump anymore), "RCPT TO: " was *NOT* put before the
> > recipient email address.
>
> [...]
>
> > Ok, I'll see what happens when I turn off pipelining for these hosts.
>
> To follow-up on this and for reference: excluding PIPELINGING doesn't
> solve this problem.
>
> Sanitized logs about such session can be found here:
> http://www.sterenborg.info/GW-no-rcptto-pf_log.txt
> http://www.sterenborg.info/GW-no-rcptto-ngrep.txt

Unfortunately, only a packet recording (network-level) with all
the ACK packets, byte offsets, and TCP flags can give deeper insight
why the RCPT TO is not received. It could be a problem of overlapping
data (multiple packets with different data having the same byte
offset in the stream, where the first or last packet is ignored
depending on the receiving system's network stack).

> I guess that since this is doesn't seem to be Postfix related it must be
> GroupWise (or the PIX with smtp-fixup *disabled*, but I haven't heard of
> a PIX sometimes removing "RCPT TO:" commands)..

If the client really does not send "RCPT TO" before the recipient
address, there is no way that the mail would be accepted by any
MTA. In this respect Postfix is no different than other MTAs.

        Wietse