rspamd 1.7.8

[navossoc]

New version:
https://github.com/vstakhov/rspamd/releases/tag/1.7.8

Should I keep posting this or does it not help you at all?

[]'s

[hardware]

Mailserver doesn't works properly after the last version (1.7.8). I have multiple regressions with rspamd :

✗ checking smtp: john.doe should have received 4 mails (internal + external + subaddress + hostmaster alias) (default configuration)
   (from function `assert_output' in file test/test_helper/bats-assert/src/assert.bash, line 239,
    in test file test/tests.bats, line 508)
     `assert_output 4' failed

   -- output differs --
   expected : 4
   actual   : 3
   --

✗ checking rspamd: spam filtered (default configuration)
   (from function `assert_output' in file test/test_helper/bats-assert/src/assert.bash, line 239,
    in test file test/tests.bats, line 616)
     `assert_output 1' failed

   -- output differs --
   expected : 1
   actual   : 0
   --

✗ checking rspamd: 5 messages with action no action
   (from function `assert_success' in file test/test_helper/bats-assert/src/assert.bash, line 114,
    in test file test/tests.bats, line 637)
     `assert_success' failed

   -- command failed --
   status : 1
   output :
   --

✗ checking rspamd: 2 messages with action reject
   (from function `assert_success' in file test/test_helper/bats-assert/src/assert.bash, line 114,
    in test file test/tests.bats, line 642)
     `assert_success' failed

   -- command failed --
   status : 1
   output :
   --

✗ checking postfix: two milter rejects (GTUBE + EICAR)
   (from function `assert_output' in file test/test_helper/bats-assert/src/assert.bash, line 239,
    in test file test/tests.bats, line 805)
     `assert_output 2' failed

   -- output differs --
   expected : 2
   actual   : 3
   --

✗ checking postfix: milter-reject - clamav virus found
   (from function `assert_success' in file test/test_helper/bats-assert/src/assert.bash, line 114,
    in test file test/tests.bats, line 810)
     `assert_success' failed

   -- command failed --
   status : 1
   output :
   --

✗ checking clamav: Eicar-Test-Signature FOUND
   (from function `assert_success' in file test/test_helper/bats-assert/src/assert.bash, line 114,
    in test file test/tests.bats, line 982)
     `assert_success' failed

   -- command failed --
   status : 1
   output :
   --

I can not look at it in detail at the moment, so I leave that on hold. We stay with 1.7.7.

[hardware]

@vstakhov This issue probably comes from my side, but just in case, I prefer to ask you the question. Something related to EICAR/GTUBE has changed with Rspamd 1.7.8 ? My spam unit tests fail since this release.

[vstakhov]

There was a change for Antivirus module in attachments_only mode in rspamd/rspamd@a9e3f16#diff-ae1e0d56d194eca34a14a2fa2fe1a4a4. It is not a part of 1.7.8 to my best knowledge. There was a fix about GTUBE that is presented in a message on its own: rspamd/rspamd@86dd306 but it is a part of 1.7.7 as well.

[hardware]

Thank you.

All my tests pass successfully with the 1.7.7 build. I will dig in detail what is wrong in my tests with the new version.

[navossoc]

@hardware did you try to revert my changes about the clamav with 1.7.8 to see if it is works? I'll try to test this later.

…

On Thu, Jul 19, 2018, 10:26 hardware ***@***.***> wrote: Thank you. All my tests pass successfully with the 1.7.7 build. I will dig in detail what is wrong in my tests with the new version. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#7 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACV--qvRds-5iJZ5PGQYqHQuWU5-a-9lks5uIIkcgaJpZM4VN8TS> .

[hardware]

Your changes are not the problem I think, they also fail with the old method. This is not debian related neither, something in rspamd 1.7.8 changed and breaks these tests.

[navossoc]

Well, you are probably right.

I did rebuild all images and run the tests:

hardware/mailserver (master branch) + hardware/debian-mail-overlay (1.7.6 tag) = ok
hardware/mailserver (master branch) + hardware/debian-mail-overlay (1.7.7 tag) = ok
hardware/mailserver (master branch) + hardware/debian-mail-overlay (1.7.8 tag) = fail

[navossoc]

Well, I got more info, maybe @vstakhov can help.

It's broken since here:

$ git bisect good
b48746cfac2a2cb05082707a9ed505bafd328d40 is the first bad commit
commit b48746cfac2a2cb05082707a9ed505bafd328d40
Author: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date:   Mon Jul 9 14:40:21 2018 +0100

    [Minor] Count a new message when checking ratelimit burst

:040000 040000 e3fa500de52ba73227f7675de82d1b48c05acfe6 9765a49024fb06605f6b288633341983e55af7a7 M      src

$ git bisect log
git bisect start
# good: [a20e33c22d63d6d5a53b4aeda7a65c9301709dbc] Release 1.7.7
git bisect good a20e33c22d63d6d5a53b4aeda7a65c9301709dbc
# bad: [4c80975059442165f446b69d253040846e8bb088] Release 1.7.8
git bisect bad 4c80975059442165f446b69d253040846e8bb088
# good: [d3c4028f4da8e84ffb54198d42637778a3becb69] [Minor] JS: Remove redundant quotes
git bisect good d3c4028f4da8e84ffb54198d42637778a3becb69
# good: [d7fdd3d33782ffc5ee961e25c07e2df5aec6b53a] [Minor] Fix aligned access
git bisect good d7fdd3d33782ffc5ee961e25c07e2df5aec6b53a
# bad: [f3d41eeed678ccedc524a82a4f6e546614821fa4] [Fix] Fix regexp functions when no data is passed
git bisect bad f3d41eeed678ccedc524a82a4f6e546614821fa4
# bad: [a444ae89b582c59aea1255f9fdf07e822f78bf26] [Minor] Cleanup, use __builtin_clz, mention algorithm source
git bisect bad a444ae89b582c59aea1255f9fdf07e822f78bf26
# bad: [b48746cfac2a2cb05082707a9ed505bafd328d40] [Minor] Count a new message when checking ratelimit burst
git bisect bad b48746cfac2a2cb05082707a9ed505bafd328d40
# good: [66d75d8d236564a39a8382c61a517c4c1aa54a8d] [Fix] Eliminate all specific C plugins pools
git bisect good 66d75d8d236564a39a8382c61a517c4c1aa54a8d
# first bad commit: [b48746cfac2a2cb05082707a9ed505bafd328d40] [Minor] Count a new message when checking ratelimit burst

The latest commit on rspamd:master (ffb00b5) is also broken.

[hardware]

I found the problem, in mailserver_default test scenario, rspamd ratelimiting is triggered and then, cascading effect. Something has changed sensibly at this level with the 1.7.8 release.

I have to tweak rates values a bit to pass the tests.

rates {
  # Limit for all mail per recipient (rate 2 per minute)
  to = "2 / 1m";
  # Limit for all mail per one source ip (rate 3 per minute)
  to_ip = "3 / 1m";
  # Limit for all mail per one source ip and from address (rate 2 per minute)
  to_ip_from = "2 / 1m";
  # Limit for all bounce mail (rate 2 per hour)
  bounce_to = "2 / 1h";
  # Limit for bounce mail per one source ip (rate 1 per hour)
  bounce_to_ip = "1 / 1h";
  # Limit for all mail per authenticated user (rate 2 per minute)
  user = "2 / 1m";
}

I just realized that the current values are absolutely not suitable for running the test phase, but there have been no problems so far with these values.

[vstakhov]

Yes, because of the bug in ratelimits module that has been fixed.

…

On 20 July 2018 08:34:38 hardware ***@***.***> wrote: I found the problem, in [mailserver_default](https://github.com/hardware/mailserver/blob/70efcf1d75ef61ef350a4f65ddc80f519ffbf804/Makefile#L47-L65) test scenario, rspamd ratelimiting is triggered and then, cascading effect. Something has changed sensibly at this level with the 1.7.8 release. I have to tweak rates values a bit to pass the tests. ``` rates { # Limit for all mail per recipient (rate 2 per minute) to = "2 / 1m"; # Limit for all mail per one source ip (rate 3 per minute) to_ip = "3 / 1m"; # Limit for all mail per one source ip and from address (rate 2 per minute) to_ip_from = "2 / 1m"; # Limit for all bounce mail (rate 2 per hour) bounce_to = "2 / 1h"; # Limit for bounce mail per one source ip (rate 1 per hour) bounce_to_ip = "1 / 1h"; # Limit for all mail per authenticated user (rate 2 per minute) user = "2 / 1m"; } ``` I just realized that the current values are absolutely not suitable for running the test phase, but there have been no problems so far with these values. -- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #7 (comment)

[hardware]

Lesson of the day : always trust unit tests. If something goes wrong, there must be a reason. 😄

I will rollback the master branch to rspamd 1.7.7 because of a bug in ratelimit.lua with 1.7.8 : rspamd/rspamd#2360

[vstakhov]

JFYI: ratelimit module is not enabled by default and, hence, not tested. However, you are free to contribute your test cases (with the appropriate config) to Rspamd functional tests: https://github.com/vstakhov/rspamd/tree/master/test/functional

[navossoc]

I will rollback the master branch to rspamd 1.7.7 because of a bug in ratelimit.lua with 1.7.8.

Well I'm using 1.7.8, but my RATELIMIT is disabled.
I didn't find any good values for it yet, so I had it disabled.

I think I'm safe for now.

Thanks for reporting...