Tomoyuki Murakami:
> > Tomoyuki Murakami:
> >> Wietse,
> >> thanks for reply.
> >>
> >> > Tomoyuki Murakami:
> >> >> I'm currently making a trial of postscreen DROP action.
> >> >> DROP action is useful for reducing cost of tests, especially
> >> >> skipping DNSBL checks are meaningful.
> >> >> OTOH, we sometimes need SMTP envelope info to make statistics
> >> >> later. the DROP action may also drops the chance of collecting
> >> >> these info.
> >> >
> >> > The ENFORCE action was implemented for exactly this purpose.
> >> >
> >> > What is the benefit of skipping the other checks?
> >>
> >> Main purpose here I have is logging even if the client IP should
> >> be blocked (for the policy, etc.). In addition, SMTP envelopes
> >
> > The ENFORCE action already implements this.
>
> But, ENFORCE "Allow other tests to complete." and, this point IS,
> may be reduced/skipped for saving resources, I thought.
In the "after 220 greeting" phase, the currently implemented tests
cost almost nothing: pipelining, bare newline, and non-SMTP
commands. The "after 220 greeting" greylisting test is more
expensive, and hasn't been implemented yet. Expensive tests like
this should only be done for clients that fail no other tests.
In the "before 220 greeting" phase, the time consuming test is
PREGREET, and postscreen could save time if the DNSBL test says
that a client is malicious. This however requires that postscreen
evaluates the DNSBL result as soon as it is available. Currently,
postscreen evaluates the DNSBL result after the PREGREET test
completes (read timeout, or the client spoke too soon), and the
patch did not change that if I recall correctly :-).
Before a SKIP action can be properly implemented, postscreen needs
to be simplified. The code manipulates (too) many flags: noforward,
todo, done, pass, fail, skip, with subtle dependencies described
in postscreen.h. These flags evolved in an ad-hoc manner as more
tests were added to the program.
Wietse
