Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

panic: cleanup_find_header_start: short header without padding

3 views
Skip to first unread message

Daniel Caillibaud

unread,
Sep 30, 2015, 6:55:17 AM9/30/15
to
Hi,

I have quite a lot (~200 / day)
panic: cleanup_find_header_start: short header without padding
in my mail.log

eg :

2015-09-30T12:37:46.834899+02:00 mail postfix/cleanup[26180]: 6CB5AD60497: prepend: header Received: from ns236029.ovh.net (sm11.netitmail.net [91.121.52.183])??by mail.sesamath.net (Postfix) with ESMTP id 6CB5AD60497??for <con...@sesamath.net>; Wed, 30 Sep 2015 12:37:42 +0200 (CEST) from sm11.netitmail.net[91.121.52.183]; from=<mensup...@warmup.netit03.net> to=<con...@sesamath.net> proto=ESMTP helo=<ns236029.ovh.net>: X-Bulk: YES
2015-09-30T12:37:46.834918+02:00 mail postfix/cleanup[26180]: 6CB5AD60497: message-id=<ba7996a4b39fbe7f...@localhost.localdomain>
2015-09-30T12:37:46.834927+02:00 mail postfix/cleanup[26180]: 6CB5AD60497: prepend: header List-Unsubscribe: <http://f1.netit04.net/?D=warmup-h6t3e1vy-i9zjz7puqt&act=unsuscribe> from sm11.netitmail.net[91.121.52.183]; from=<mensup...@warmup.netit03.net> to=<con...@sesamath.net> proto=ESMTP helo=<ns236029.ovh.net>: X-Bulk: YES
2015-09-30T12:37:46.842393+02:00 mail postfix/cleanup[26180]: panic: cleanup_find_header_start: short header without padding

whith lines like
/^Received:.*\.(well known spammers regex)/ PREPEND X-Bulk: YES
or
/subscribe/ PREPEND X-Bulk: YES

I'm using
header_checks = pcre:/etc/postfix/header_checks.pcre

this file seems ok (checked with postmap -fq - pcre:/etc/postfix/header_checks.pcre, and I'm receiving mail with these prepend headers),
but I was wondering if the "short header without padding" could occurs on my prepend header

Any idea ?

Thanks

--
Daniel

Viktor Dukhovni

unread,
Sep 30, 2015, 8:42:11 AM9/30/15
to
On Wed, Sep 30, 2015 at 12:54:51PM +0200, Daniel Caillibaud wrote:

> I have quite a lot (~200 / day)
> panic: cleanup_find_header_start: short header without padding
> in my mail.log

This looks like a bug in the Postfix milter support code, or its
interaction with cleanup header_checks.

> 2015-09-30T12:37:46.834899+02:00 mail postfix/cleanup[26180]: 6CB5AD60497:
> prepend: header
> Received: from ns236029.ovh.net (sm11.netitmail.net [91.121.52.183])
> by mail.sesamath.net (Postfix) with ESMTP id 6CB5AD60497
> for <con...@sesamath.net>; Wed, 30 Sep 2015 12:37:42 +0200 (CEST)
> from sm11.netitmail.net[91.121.52.183];
> from=<mensup...@warmup.netit03.net> to=<con...@sesamath.net>
> proto=ESMTP helo=<ns236029.ovh.net>:
> X-Bulk: YES

Cleanup prepends this header above the message, not sure whether
"padding" required for subsequent milter updates is inserted as
required. Headers shorter than 15 bytes need padding for any
subsequent milter updates.

> 2015-09-30T12:37:46.834927+02:00 mail postfix/cleanup[26180]: 6CB5AD60497:
> prepend: header
> List-Unsubscribe: <http://f1.netit04.net/?D=warmup-h6t3e1vy-i9zjz7puqt&act=unsuscribe>
> from sm11.netitmail.net[91.121.52.183];
> from=<mensup...@warmup.netit03.net>
> to=<con...@sesamath.net> proto=ESMTP helo=<ns236029.ovh.net>:
> X-Bulk: YES

Second prepend of the same header.

> 2015-09-30T12:37:46.842393+02:00 mail postfix/cleanup[26180]: panic:
> cleanup_find_header_start: short header without padding

Then a milter update request fails.


> I'm using
> header_checks = pcre:/etc/postfix/header_checks.pcre

You're also using milters, any hints as to what the milter is
configured to do?

> but I was wondering if the "short header without padding" could occurs on my prepend header
>
> Any idea ?

A quick work-around would be to change the header to:

X-Bulk: detected

which is long enough to not require "padding".

--
Viktor.

Viktor Dukhovni

unread,
Sep 30, 2015, 9:24:22 AM9/30/15
to
On Wed, Sep 30, 2015 at 12:54:51PM +0200, Daniel Caillibaud wrote:

> I have quite a lot (~200 / day)
> panic: cleanup_find_header_start: short header without padding
> in my mail.log

The patch below might help:

diff --git a/src/cleanup/cleanup_message.c b/src/cleanup/cleanup_message.c
index 47b7177..b0ae686 100644
--- a/src/cleanup/cleanup_message.c
+++ b/src/cleanup/cleanup_message.c
@@ -385,11 +385,15 @@ static const char *cleanup_act(CLEANUP_STATE *state, char *context,
if (STREQUAL(value, "PREPEND", command_len)) {
if (*optional_text == 0) {
msg_warn("PREPEND action without text in %s map", map_class);
- } else if (strcmp(context, CLEANUP_ACT_CTXT_HEADER) == 0
- && !is_header(optional_text)) {
- msg_warn("bad PREPEND header text \"%s\" in %s map -- "
- "need \"headername: headervalue\"",
- optional_text, map_class);
+ } else if (strcmp(context, CLEANUP_ACT_CTXT_HEADER) == 0) {
+ if (!is_header(optional_text)) {
+ msg_warn("bad PREPEND header text \"%s\" in %s map -- "
+ "need \"headername: headervalue\"",
+ optional_text, map_class);
+ return (buf);
+ }
+ cleanup_act_log(state, "prepend", context, buf, optional_text);
+ cleanup_out_header(state, optional_text);
} else {
cleanup_act_log(state, "prepend", context, buf, optional_text);
cleanup_out_string(state, REC_TYPE_NORM, optional_text);

--
Viktor.

Daniel Caillibaud

unread,
Sep 30, 2015, 9:51:12 AM9/30/15
to
Le 30/09/15 à 12:41, Viktor Dukhovni <postfi...@dukhovni.org> a écrit :
[…]
VD> Second prepend of the same header.
VD>
VD> > 2015-09-30T12:37:46.842393+02:00 mail postfix/cleanup[26180]: panic:
VD> > cleanup_find_header_start: short header without padding
VD>
VD> Then a milter update request fails.

Thanks for clear explanation

VD> > I'm using
VD> > header_checks = pcre:/etc/postfix/header_checks.pcre
VD>
VD> You're also using milters, any hints as to what the milter is
VD> configured to do?

It's for opendkim :

smtpd_milters = inet:localhost:12345
non_smtpd_milters = inet:localhost:12345
milter_connect_macros = j
milter_protocol = 3


VD> A quick work-around would be to change the header to:
VD>
VD> X-Bulk: detected
VD>
VD> which is long enough to not require "padding".

Thanks a lot, my users have MUA filters based on existing, so I change to
/…/ PREPEND X-Bulk: YES detected

And it seems to solve the pb

--
Daniel

Wietse Venema

unread,
Sep 30, 2015, 10:08:34 AM9/30/15
to
Viktor Dukhovni:
> On Wed, Sep 30, 2015 at 12:54:51PM +0200, Daniel Caillibaud wrote:
>
> > I have quite a lot (~200 / day)
> > panic: cleanup_find_header_start: short header without padding
> > in my mail.log
>
> The patch below might help:

Indeed. The bug was that all PREPENDed text was output with
cleanup_out_string(), whereas headers must be output with
cleanup_out_header().

Wietse

Viktor Dukhovni

unread,
Sep 30, 2015, 10:21:15 AM9/30/15
to
On Wed, Sep 30, 2015 at 03:50:50PM +0200, Daniel Caillibaud wrote:

> VD> You're also using milters, any hints as to what the milter is
> VD> configured to do?
>
> It's for opendkim :
>
> smtpd_milters = inet:localhost:12345
> non_smtpd_milters = inet:localhost:12345
> milter_connect_macros = j
> milter_protocol = 3

So presumably this milter prepends another header, "Authentication-Results:"
(inbound) or "DKIM-Signature:" (outbound).

This "prepend" action might run into trouble if the top-most header
is short and non "padded.

> VD> A quick work-around would be to change the header to:
> VD>
> VD> X-Bulk: detected
> VD>
> VD> which is long enough to not require "padding".
>
> Thanks a lot, my users have MUA filters based on existing, so I change to
> /…/ PREPEND X-Bulk: YES detected
>
> And it seems to solve the pb

Not so much solve, as "work-around". Any chance you could build
from source and try the patch? If you build the exact same Postfix
release you're running, it suffices to replace just the "cleanup"
program in /usr/libexec/postfix/, while leaving the rest of the
install as-is. (You can save the original "cleanup" and put it
back when testing is done).

Do:

# cd /usr/libexec/postfix
# cp /build/directory/.../libexec/cleanup cleanup.new
# chmod 755 cleanup
# ln -f cleanup cleanup.orig
# mv cleanup.new cleanup

Undo:

# mv cleanup.orig cleanup

--
Viktor.

Daniel Caillibaud

unread,
Oct 1, 2015, 5:23:20 AM10/1/15
to
Le 30/09/15 à 14:20, Viktor Dukhovni <postfi...@dukhovni.org> a écrit :
VD> Any chance you could build from source and try the patch?

I'm using the wheezy debian package

VD> If you build the exact same Postfix
VD> release you're running, it suffices to replace just the "cleanup"
VD> program in /usr/libexec/postfix/, while leaving the rest of the
VD> install as-is. (You can save the original "cleanup" and put it
VD> back when testing is done).

I should get the source of the debian package, apply patch and compile, then replace the
cleanup bin, set my pcre filter like before the workaround and observe what happen.

I will and let you know (but this week is very busy, I'll try soon).

--
Daniel

Imaginer, c'est hausser le réel d'un ton.
Gaston Bachelard

Wietse Venema

unread,
Oct 3, 2015, 8:31:47 PM10/3/15
to
Viktor Dukhovni:
> On Wed, Sep 30, 2015 at 12:54:51PM +0200, Daniel Caillibaud wrote:
>
> > I have quite a lot (~200 / day)
> > panic: cleanup_find_header_start: short header without padding
> > in my mail.log
>
> The patch below might help:

To avoid a segfault, use the patch below. This applies to all
supported Postfix releases (2.9 and onwards).

Wietse

--- /var/tmp/postfix-3.1-20150924/src/cleanup/cleanup_message.c 2014-12-06 20:35:33.000000000 -0500
+++ src/cleanup/cleanup_message.c 2015-10-03 20:24:20.000000000 -0400
@@ -385,11 +385,19 @@
if (STREQUAL(value, "PREPEND", command_len)) {
if (*optional_text == 0) {
msg_warn("PREPEND action without text in %s map", map_class);
- } else if (strcmp(context, CLEANUP_ACT_CTXT_HEADER) == 0
- && !is_header(optional_text)) {
- msg_warn("bad PREPEND header text \"%s\" in %s map -- "
- "need \"headername: headervalue\"",
- optional_text, map_class);
+ } else if (strcmp(context, CLEANUP_ACT_CTXT_HEADER) == 0) {
+ if (!is_header(optional_text)) {
+ msg_warn("bad PREPEND header text \"%s\" in %s map -- "
+ "need \"headername: headervalue\"",
+ optional_text, map_class);
+ } else {
+ VSTRING *temp; /* XXX Impedance mismatch. */
+
+ cleanup_act_log(state, "prepend", context, buf, optional_text);
+ temp = vstring_import(mystrdup(optional_text));
+ cleanup_out_header(state, temp);
+ vstring_free(temp);
+ }

Viktor Dukhovni

unread,
Oct 4, 2015, 9:15:45 PM10/4/15
to
On Thu, Oct 01, 2015 at 11:23:05AM +0200, Daniel Caillibaud wrote:

> I should get the source of the debian package, apply patch and compile, then replace the
> cleanup bin, set my pcre filter like before the workaround and observe what happen.
>
> I will and let you know (but this week is very busy, I'll try soon).

For the record, use Wietse's updated patch, mine was wrong. I
posted it before trying to compile or double checking the interface...
The cleanup_out_header() function wants the header as a (VSTRING
*), not a (char *).

If you can't test, that's OK, we're fairly confident this is the
right fix given the reported symptoms and that prepending a longer
header works around the issue.

--
Viktor.

0 new messages