Re: Strange persistant 'timeout after DATA' from mail2.bund.de

11 msg	Reject unknown Sender address
10 msg	Postfix and archiving
5 msg	-o content_filter overrides main.cf ?
1 msg	Postfix 2.4.3 and 2.3.11 available
8 msg	SASL authentication via dovecot?
2 msg	postfix/sasl: sql_select option missing - wtf?
3 msg	max connection rate/count/limit issues.
1 msg	requeue mails
6 msg	nothing in maillog
9 msg	local and remote storage for same user
7 msg	Rejecting Invaliud Users - Useful Resource poin...
4 msg	Distributing map files
5 msg	relay_recipient_maps for multiple destinations
13 msg	auto-responders with postfix
6 msg	Mydestination with virtual domains
6 msg	Splitting smtpd_proxy_filter in smtpd_recipient...
10 msg	Can't Send to Sprint Messaging Users..
1 msg	MAAWG meeting anyone?
2 msg	basic postfix 2.4.1 configuration for a simple ...

Strange persistant 'timeout after DATA' from ma...
\ lst_hoe01 (30 May 2007)
. \ (Wietse Venema) (30 May 2007)
. . \ lst_hoe01 (30 May 2007)
. . . \ (Wietse Venema) (30 May 2007)
. . . . \ lst_hoe01 (30 May 2007)

Subject:	Re: Strange persistant 'timeout after DATA' from mail2.bund.de
Group:	Postfix-users
From:	lst_hoe01
Date:	30 May 2007

Zitat von Wietse Venema <wietse>:

> lst_hoe01:
>> > The plaintext handicaps analysis. Each packet is spread out over a
>> > no less than 70 lines.
>> >
>> > The plaintext does not show the SMTP client DATA command.
>> >
>> > You may try to turn off ESMTP command PIPELINING support with
>> > smtpd_discard_ehlo_keyword_address_maps or smtpd_discard_ehlo_keywords.
>> >
>> > Wietse
>>
>> The dump is cleartext because we don't want to expose the e-Mail
>> addresses to the list and i don't know how to alter the raw output
>> from "tcpdump". I can sent you the unaltered data in private e-Mail
>> but i don't have the "SMTP client DATA" in it either.
>
> The capture file shows that the client DOES send the DATA command.
> It's your text formatter that deletes protocol AAAArmation that it
> does not understand.
>
> Stop using this broken tool. Even less(1) does a better job at SMTP
> protocol analysis.

It was a simple text export from wireshark (formerly ethereal) and
indeed the SMTP analysis does not show the DATA command, but in the
raw data it is present beside the RCPT-TO. Sorry for not being careful
enough at this point.

> The session as captured goes like this:
>
> S:220 mailin.kwsoft.de ESMTP Postfix
>
> C:EHLO fw-berlin.bund.de
>
> S:250-mailin.kwsoft.de
> 250-PIPELINING
> 250-SIZE 30000000
> 250-VRFY
> 250-ETRN
> 250-STARTTLS
> 250-ENHANCEDSTATUSCODES
> 250-8BITMIME
> 250 DSN
>
> C:MAIL From:<AAAAAAA.AAAAAA> SIZE=698024
>
> S:250 2.1.0 Ok
>
> C:RCPT To:<AAAA>
> DATA
>
> S:250 2.1.5 Ok
> S:354 End data with <CR><LF>.<CR><LF>
> S:421 4.4.2 mailin.kwsoft.de Error: timeout exceeded
>
> C:Received: (from root@localhost)
> by fw-berlin.bund.de (8.13.8/8.11.6) id l4MBX4ID005963
> ...
>
> The client PIPELINEs the RCPT and DATA commands. Postfix receives
> DATA command and responds with 250, then something upstream screws
> up.
>
> Some "security firewall" products mis-handle pipelined SMTP commands,
> just like your packet dumping tool.
>
> This is why I asked you to turn off PIPELINING.
>
>> We have already tried to disable the ESMTP extensions but no luck...
>>
>> May 29 09:11:39 web postfix/smtpd[30410]: connect from
>> mail2.bund.de[194.95.177.104]
>> May 29 09:11:39 web postfix/smtpd[30410]: discarding EHLO keywords:
>> AUTH ETRN PIPELINING SIZE VRFY STARTTLS
>> May 29 09:11:39 web postfix/smtpd[30410]: 6295A7D209:
>> client=mail2.bund.de[194.95.177.104]
>> May 29 09:12:14 web postfix/smtpd[30410]: timeout after DATA from
>> mail2.bund.de[194.95.177.104]
>> May 29 09:12:14 web postfix/smtpd[30410]: disconnect from
>> mail2.bund.de[194.95.177.104]
>
> Apparently the same something still screws up. At this point
> the client should be sending commands one at a time, without
> pipelining.
>
> You may want to check this with tcpdump.
>
> Good luck, this is no longer a Postfix problem.
>
> Wietse

I have not really suspected a postfix problem but wanted to get a
second opinion what is going on.

Thanxs for the verification.

Regards

Andreas