[Mimedefang] stream_by_recipient and Postfix

David F. Skoll dfs at roaringpenguin.com
Tue Nov 22 09:12:40 EST 2011


On Tue, 22 Nov 2011 14:49:37 +0100
"Rolf E. Sonneveld" <R.E.Sonneveld at sonnection.nl> wrote:

> Is this sufficient 'evidence' that MD + stream_by_recipient()+
> Postfix (non_smptd_milters) provides a solution to the problem of
> treating a multi-recipient message differently based upon different
> 'per-user' preferences/settings? Any things I forgot? Any caveats?

It looks like it's working.  However, there's one caveat:  With real Sendmail,
MIMEDefang redelivers the streamed messages using deferred mode.  That means
they just get queued up.  A short time later, the queue is run and the
remailed messages appear.

This means that if a message has 100 recipients, they get queued up and
then redelivered in a nicely serialized way with limited parallelism.  If
Postfix actually redelivers the messages immediately, an N-recipient message
might try to tie up N scanning processes all at about the same time.

I'm not sure if this will be a problem in practice, but it's something to
watch for.  You don't want to allow an attacker to DoS your machine by sending
messages to large numbers of recipients and relying on amplification.

Regards,

David.



More information about the MIMEDefang mailing list