Sub OnDeliveryFailed(oMessage, sRecipient, sErrorMessage)

[SorenR]

hMailServer 5.6.8 B2505.RvdH_based_with_a_few_mods.

I swear that I have NOT changed ANY code pertaining to rules and/or delivery ... I have corrected vbscript/jscript script calling in POP3, IMAP and SMTP but that should NOT do this ...

Completely out of the blue I am now getting delivery errors ... And they are perfectly spot on !?!?!

I have a couple of global rules handling SPAM. The main ones are:
1: Score < 7 move to SPAM-folder AND copy to spam@mydomain..
2: Score > 6 copy to spam@mydomain AND delete mail..

The error message I get is: "Message delivery cancelled during global rules" ... Yes? I delete the email in the rule! Why bitch about this now?

This is triggered when it happens and I have had to insert a "file exist check" to avoid an entry in the ERROR logging.
.

Code: Select all

Sub OnDeliveryFailed(oMessage, sRecipient, sErrorMessage)
    Dim fso : Set fso = CreateObject("Scripting.FileSystemObject")
    Dim strRegEx, oMatch, oMatchCollection, strResult, strFilename
    Dim EventLogX : Set EventLogX = New LogWriter
    EventLogX.LogFile = "deliveryfail"
    '
    '   Weird stuff
    '
    strRegEx = "^(?:.*Remote server replied:\s)([0-9]{3})(?:\s.*)$"
    Set oMatchCollection = oLookup(strRegEx, sErrorMessage, False)
    For Each oMatch In oMatchCollection
        If oMatch.SubMatches.Count > 0 Then strResult = oMatch.SubMatches(0)
    Next
    EventLogX.Write( LPad("DeliveryFailed", 15, " ") & vbTab & "sRecipient = " & sRecipient )
    EventLogX.Write( LPad("DeliveryFailed", 15, " ") & vbTab & "sErrorMessage = " & sErrorMessage )
    EventLogX.Write( LPad("DeliveryFailed", 15, " ") & vbTab & "oMessage.Filename = " & oMessage.Filename )
    '
    '   Return mail with message
    '
    If fso.FileExists(oMessage.Filename) Then
        With CreateObject("hMailServer.Message")
            strFilename = .Filename
            fso.CopyFile oMessage.Filename, strFilename, True
            .RefreshContent
            .AddRecipient oMessage.HeaderValue("X-Envelope-From"), oMessage.HeaderValue("X-Envelope-From")
            .Subject = "[* FAILED DELIVERY *] " & .Subject
            .Body = LPad("DeliveryFailed", 15, " ") & vbTab & sRecipient & vbTab & strResult & vbNewLine & _
                    LPad("DeliveryFailed", 15, " ") & vbTab & sRecipient & vbTab & sErrorMessage & vbNewLine & .Body
            .Save
        End With
    Else
        EventLogX.Write( LPad("DeliveryFailed", 15, " ") & vbTab & "oMessage.Filename = ** DELETED **" )
    End If
    Set EventLogX = Nothing
    Set oMatch = Nothing
    Set oMatchCollection = Nothing
    Set fso = Nothing
End Sub

Christmas ghost showing his ugly face or gremlins?

[palinka]

Have you tried de-ordinating the flux capacitor?

[palinka]

Christmas ghost showing his ugly face or gremlins?

Krampus.

Just reboot and you'll be fine.

[RvdH]

You have been tinkering with the code to much?

Anyway...what is the purpose of "Add HELO/EHLO as string to OnHELO(oClient, sTxt)"? As you already have this value available through oClient.HELO this seems completely redundant
And X-SA-hMail-Mail-From, is this related/similar as this https://www.hmailserver.com/forum/viewt ... 20#p177520

[RvdH]

OnClientLogon(oClient, sPassword)
This is a no go for me, this can be abused to collect a full list of username/passwords if someone/something has gain unauthorized access to the server running hMailServer making it vulnerable

[RvdH]

Back to topic, i don't seem to have the problem you describe above, i do exactly the same, eg: spam forwarding and spam deleting using global rules

[SorenR]

OnClientLogon(oClient, sPassword)
This is a no go for me, this can be abused to collect a full list of username/passwords if someone/something has gain unauthorized access to the server running hMailServer making it vulnerable

Yes, I get your concern. I may change it to only list invalid passwords. I use it to reference failed logons with sites like https://haveibeenpwned.com/

The addition to OnHELO(oClient, sTxt) is to capture "HELO" or "EHLO". I can use this to shortcircuit my IDS code if a spammer first tries a EHLO and a second later a HELO. I'm not quite done with that as I need to add an indicator for STARTTLS active.

The thing that puzzles me is the error message...

Message delivery cancelled during global rules

Martin put it in the code for a reason - probably ... Why have I not seen it before?
Rules have not been modified for years.

Hmm... Could it really be that easy?

I enabled AWStats LOG about a week ago...

SMTPDeliverer.cpp

Code: Select all

      // Apply rules on this message.
      if (!RunGlobalRules_(pMessage, globalRuleResult))
      {
         LogAwstatsMessageRejected_(sendersIP, pMessage, "Message delivery cancelled during global rules");
         return false;
      }

I'm going to switch off AWStats LOG now and see what happens ..

[RvdH]

The addition to OnHELO(oClient, sTxt) is to capture "HELO" or "EHLO". I can use this to shortcircuit my IDS code if a spammer first tries a EHLO and a second later a HELO. I'm not quite done with that as I need to add an indicator for STARTTLS active.

What shortcut? it is triggered only on OnHelo, and on HELO/EHLO you have this available to you through oClient.HELO, not? Really see no point passing this as string.

I doubt it is related due to awstats... or at least i honestly can not say i never ever have seen that message before.... maybe you should verify your jscript "fixes" don't break anything

[SorenR]

The addition to OnHELO(oClient, sTxt) is to capture "HELO" or "EHLO". I can use this to shortcircuit my IDS code if a spammer first tries a EHLO and a second later a HELO. I'm not quite done with that as I need to add an indicator for STARTTLS active.

What shortcut? it is triggered only on OnHelo, and on HELO/EHLO you have this available to you through oClient.HELO, not? Really see no point passing this as string.

I doubt it is related due to awstats... or at least i honestly can not say i never ever have seen that message before.... maybe you should verify your jscript "fixes" don't break anything

OnHELO is called on both EHLO and HELO greetings but does not differentiate between the two.

When BOT's first try they use a EHLO greeting and if you reject that they try a HELO greeting. If you get an EHLO greeting and a HELO greeting from same IP in under 1 second it is a BOT. That simple. Normal servers give up if you reject on EHLO.

[RvdH]

You do not get my point, there is NO reason to pass the HELO/EHLO greeting as a string....you ALREADY HAVE IT in oClient.HELO

[edit]
Ah, i see what you mean now... you don't pass the EHLO/HELO FCDN but only HELO/EHLO

[SorenR]

You do not get my point, there is NO reason to pass the HELO/EHLO greeting as a string....you ALREADY HAVE IT in oClient.HELO

[edit]
Ah, i see what you mean now... you don't pass the EHLO/HELO FCDN but only HELO/EHLO

Yes, and since I am still playing with it I parse it as a parameter and not part of the oClient object.

If I don't scrap the whole idea I may have the greeting type (HELO/EHLO), SSL/TLS [0|1|2] and Active Cipher as part of the oClient object ...

[SorenR]

//---------------------------------------------------------------------------()
// DESCRIPTION:
// If awstats logging is enabled, this function goes through all the recipients
// of the message, and logs to the awstats log that they have been rejected.
// This is used if a message is rejected after it has been transferred from the
// client to the server.
//---------------------------------------------------------------------------()

Hmm... Events::FireOnDeliveryFailed(pMessage, sSendersIP, sRecipientAddress, sReason);
.

Code: Select all

   SMTPDeliverer::LogAwstatsMessageRejected_(const String &sSendersIP, std::shared_ptr<Message> pMessage, const String &sReason)
   //---------------------------------------------------------------------------()
   // DESCRIPTION:
   // If awstats logging is enabled, this function goes through all the recipients
   // of the message, and logs to the awstats log that they have been rejected.
   // This is used if a message is rejected after it has been transferred from the
   // client to the server.
   //---------------------------------------------------------------------------()
   {
      // Check that message exists, and that the awstats log is enabled.
      if (!pMessage || !AWStats::GetEnabled())
         return;

      // Go through the recipients and log one row for each of them.
      String sFromAddress = pMessage->GetFromAddress();     

      const std::vector<std::shared_ptr<MessageRecipient> > vecRecipients = pMessage->GetRecipients()->GetVector();
      std::vector<std::shared_ptr<MessageRecipient> >::const_iterator iterRecipient = vecRecipients.begin();
      while (iterRecipient != vecRecipients.end())
      {
         String sRecipientAddress = (*iterRecipient)->GetAddress();

         // Log the error message
         AWStats::LogDeliveryFailure(sSendersIP, pMessage->GetFromAddress(), sRecipientAddress,  550);
         Events::FireOnDeliveryFailed(pMessage, sSendersIP, sRecipientAddress, sReason);

         iterRecipient++;
      }

   }

WHY only with AWStats active ?? ¯\_(ツ)_/¯

[SorenR]

I doubt it is related due to awstats... or at least i honestly can not say i never ever have seen that message before.... maybe you should verify your jscript "fixes" don't break anything

Disabled AWStats logging and "problem" went away ...

¯\_(ツ)_/¯

[mattg]

I was going to say that I get that message ALL of the time (hundreds of times per day), but I also log AWSTATS

[SorenR]

I was going to say that I get that message ALL of the time (hundreds of times per day), but I also log AWSTATS

I'm wondering why only when AWStats logging is active and not otherwise? It really has nothing to do with AWStats as such

[RvdH]

It ONLY has use for Awstats as i see it, this simply prevents your awstast statistics to go haywire when using global rules to delete mail

[SorenR]

It ONLY has use for Awstats as i see it, this simply prevents your awstast statistics to go haywire when using global rules to delete mail

That's BS!

I had a look at the rest of the code. There are two other procedures built the same way calling "Events::FireOnDeliveryFailed", but they actually work regardless if AWStats logging is enabled or not. I use one to capture delivery failures.

It's just crap programming.

" I'm not mad, I'm disappointed! "

[jimimaseye]

It ONLY has use for Awstats as i see it, this simply prevents your awstast statistics to go haywire when using global rules to delete mail

That's BS!

I had a look at the rest of the code. There are two other procedures built the same way calling "Events::FireOnDeliveryFailed", but they actually work regardless if AWStats logging is enabled or not. I use one to capture delivery failures.

It's just crap programming

Maybe worth a bug fix request in github and special update in rvhd custom 5.6.8?

[Entered by mobile. Excuse my spelling.]

[RvdH]

It ONLY has use for Awstats as i see it, this simply prevents your awstast statistics to go haywire when using global rules to delete mail

That's BS!

I had a look at the rest of the code. There are two other procedures built the same way calling "Events::FireOnDeliveryFailed", but they actually work regardless if AWStats logging is enabled or not. I use one to capture delivery failures.

It's just crap programming

Maybe worth a bug fix request in github and special update in rvhd custom 5.6.8?

[Entered by mobile. Excuse my spelling.]

I doubt it.... hence the function is called, SMTPDeliverer::LogAwstatsMessageRejected_(const String &sSendersIP, std::shared_ptr<Message> pMessage, const String &sReason)

For what freaking reason it would trigger anywere else?

[SorenR]

Do you see any difference in these two?

Code: Select all

      // Run virus protection.
      if (!RunVirusProtection_(pMessage))
      {
         LogAwstatsMessageRejected_(sendersIP, pMessage, "Message delivery cancelled during virus scanning");
         return false;
      }

      // Apply rules on this message.
      if (!RunGlobalRules_(pMessage, globalRuleResult))
      {
         LogAwstatsMessageRejected_(sendersIP, pMessage, "Message delivery cancelled during global rules");
         return false;
      }

So if antivirus delete my outgoing email I only get to know about it IF AWStats logging is enabled ??

[RvdH]

No, but there it simply tells to log to awstats as rejected.... the "normal" reject message for virus found is elsewhere, you are clearly mixing things up

[SorenR]

No, but there it simply tells to log to awstats as rejected.... the "normal" reject message for virus found is elsewhere, you are clearly mixing things up

I'll repost...

Code: Select all

   SMTPDeliverer::LogAwstatsMessageRejected_(const String &sSendersIP, std::shared_ptr<Message> pMessage, const String &sReason)
   //---------------------------------------------------------------------------()
   // DESCRIPTION:
   // If awstats logging is enabled, this function goes through all the recipients
   // of the message, and logs to the awstats log that they have been rejected.
   // This is used if a message is rejected after it has been transferred from the
   // client to the server.
   //---------------------------------------------------------------------------()
   {
      // Check that message exists, and that the awstats log is enabled.
      if (!pMessage || !AWStats::GetEnabled())
         return;

      // Go through the recipients and log one row for each of them.
      String sFromAddress = pMessage->GetFromAddress();     

      const std::vector<std::shared_ptr<MessageRecipient> > vecRecipients = pMessage->GetRecipients()->GetVector();
      std::vector<std::shared_ptr<MessageRecipient> >::const_iterator iterRecipient = vecRecipients.begin();
      while (iterRecipient != vecRecipients.end())
      {
         String sRecipientAddress = (*iterRecipient)->GetAddress();

         // Log the error message
         AWStats::LogDeliveryFailure(sSendersIP, pMessage->GetFromAddress(), sRecipientAddress,  550);
         Events::FireOnDeliveryFailed(pMessage, sSendersIP, sRecipientAddress, sReason);

         iterRecipient++;
      }

   }

I beg to differ... "Events::FireOnDeliveryFailed(pMessage, sSendersIP, sRecipientAddress, sReason);" is only triggered IF AWStats logging is active!

Yes, the sender get a notification but there is NO DeliveryFailure trigger UNLESS AWStats logging is enabled and perhaps someone else (hint: ADMIN/Postmaster) would like to know about it!

[SorenR]

Fixed it...

[jimimaseye]

Fixed it...

Turned awstats logging off?

[palinka]

Fixed it...

Turned awstats logging off?

He de-ordinated the flux capacitor. Exactly what I told him to do in the beginning.

[SorenR]

Fixed it...

Turned awstats logging off?

He de-ordinated the flux capacitor. Exactly what I told him to do in the beginning.

The only reason there is such a thing called Flux Capacitor is that the De Lorean was born a lemon
It was largely unable to reach 88 miles per hour without help.

@jimimaseye
Modified the source code to allow events without having to enable AWStats logging.

[palinka]

The only reason there is such a thing called Flux Capacitor is that the De Lorean was born a lemon

I won't disagree, but I still want one - an electric one with 3 tesla motors.

[SorenR]

The only reason there is such a thing called Flux Capacitor is that the De Lorean was born a lemon

I won't disagree, but I still want one - an electric one with 3 tesla motors.

Nah... Mine is white --> https://www.youtube.com/watch?v=aWfurFjsUwg