Package: policyd-weight Version: 0.1.15.2-5 Severity: normal Dear Maintainer,
I have several problems with policyd on an IPv6-only machine. Those are detailled below. Please find in 3. a bit of analyze of the root cause. 0. libnet-dns-perl does not install libio-socket-inet6-perl as a dependency. ============================================================================ This is not really related to policyd-weight, but that took me some time to understand that policyd-weight would not work on an IPv6-only setup, even bugfree, because of libio-socket-inet6-perl being not installed as dependency of libnet-dns-perl. 1. infinite loop (100% cpu used) with default configuration =========================================================== Reproduces step: * configure system resolver(s) to be IPv6 addresses, * launch policyd-weight with default configuration (with $DEBUG=1 for more logging), * test the dnsbl checks, for example by telneting the port and giving this data, terminated with an empty line: request=smtpd_access_policy protocol_state=RCPT protocol_name=SMTP helo_name=hello.example.com client_address=1.3.4.5 reverse_client_name=hello.example.com [email protected] Observed behaviour: * the process never answers, and use 100% CPU per child ; * the following logs are shown: postfix/policyd-weight[16203]: child: spawned postfix/policyd-weight[16203]: cache_query: ask 1.3.4.5 [email protected] domain.com postfix/policyd-weight[16203]: cache_query: "[email protected] 0" vs "[email protected] " postfix/policyd-weight[16203]: rbl_lookup: sending: 5.4.3.1.pbl.spamhaus.org, 62308 postfix/policyd-weight[16203]: warning: child: err: send: Cannot determine peer address at /usr/sbin/policyd-weight line 3551#012 postfix/policyd-weight[16203]: warning: rbl_lookup: timeout sending: 5.4.3.1.pbl.spamhaus.org postfix/policyd-weight[16203]: rbl_lookup: sending: 5.4.3.1.pbl.spamhaus.org, 62308 (last logs repeating... infinite loop...) Expected behaviour: * the process answers the action to take for this data, or at least fails with understandable error. 2. with $USE_NET_DNS = 1; in conf: resolves fail each time. =========================================================== The aim of setting this option was to avoid passing through the code that did infinite loop. Reproduces step: * configure system resolver(s) to be IPv6 addresses, * launch policyd-weight with $DEBUG=1 and $USE_NET_DNS=1 * test the dnsbl checks, for example by telneting the port and giving this data, terminated with an empty line: request=smtpd_access_policy protocol_state=RCPT protocol_name=SMTP helo_name=hello.example.com client_address=1.3.4.5 reverse_client_name=hello.example.com [email protected] Observed behaviour: * the process answers: action=PREPEND X-policyd-weight: passed - too many local DNS-errors in bl.spamcop.net lookups * the following logs are shown: postfix/policyd-weight[16644]: child: spawned postfix/policyd-weight[16644]: cache_query: ask 1.3.4.5 [email protected] domain.com postfix/policyd-weight[16644]: cache_query: "[email protected] 0" vs "[email protected] " postfix/policyd-weight[16644]: decided action=PREPEND X-policyd-weight: passed - too many local DNS-errors in bl.spamcop.net lookups; <instance=> <client=[1.3.4.5]> <helo=hello.example.com> <[email protected]> <to=>; delay: 0s Expected behaviour: * there should be no error on DNS lookups. 3. Analyze: a call to Net::DNS::Resolver:force_v4 ================================================= The problem probably comes from the force_v4(1) call on /usr/sbin/policyd-weight:897 line. I tested with a simple script to resolve a name with this option set on my machine, it just won't work. 895 if(Net::DNS->version() >= 0.50) 896 { 897 $res->force_v4(1); # force ipv4 usage, autodetection is broken till 898 # Net::DNS 0.53 899 } The comment is weird: why not checking version() < 0.53 too ? Appendix: script to test resolution =================================== #!/usr/bin/env perl use Net::DNS; our $res=Net::DNS::Resolver->new; # comment this line to make it work on v6 $res->force_v4(1); my $answ = $res->send('31.33.69.181.zen.spamhaus.org'); if (!($answ)) { print "dns error\n"; } elsif(($answ->answer) > 0 ) { print "found!\n"; } else { print "not found!\n"; } Kind regards, Alexandre. -- System Information: Debian Release: 7.2 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages policyd-weight depends on: ii adduser 3.113+nmu3 ii libnet-dns-perl 0.66-2+b2 ii libnet-ip-perl 1.25-3 ii lsb-base 4.1+Debian8+deb7u1 ii perl 5.14.2-21+deb7u1 Versions of packages policyd-weight recommends: ii perl [libsys-syslog-perl] 5.14.2-21+deb7u1 policyd-weight suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
