Re: TLS Encryption and Verification issue

[Viktor Dukhovni]

On Fri, Nov 21, 2014 at 12:59:01PM -0500, Deeztek Support wrote:

> I get the following error:
> 
> Nov 21 12:52:19 smtp postfix/smtp[17859]: 9277043E30:
> to=<some...@gmail.com>,
> relay=alt4.gmail-smtp-in.l.google.com[74.125.136.26]:25, delay=5.7,
> delays=0.05/0.02/5.7/0, dsn=4.7.5, status=deferred (Server certificate not
> verified)

You're not showing the log entry for the established connection
from the Postfix TLS library.  This is rather important in this
context.

    # perl collate /var/log/mail.log |
            qid=9277043E30 perl -ne '
                    BEGIN{$/="\n\n";$re=$ENV{qid}}
                    print if m{$re}oi
                    '
 
-- 
        Viktor.

#! /usr/bin/perl

use strict;
use warnings;

# Postfix delivery agents
my @agents = qw(discard error lmtp local pipe smtp virtual);

my $instre = qr{(?x)
        \A                      # Absolute line start
        (?:\S+ \s+){3}          # Timestamp, adjust for other time formats
        \S+ \s+                 # Hostname
        (postfix(?:-\S+)?)/     # postfix instance
        };

my $cmdpidre = qr{(?x)
        \G                      # Continue from previous match
        (\S+)\[(\d+)\]:\s+      # command[pid]:
};

my %smtpd;
my %smtp;
my %transaction;
my $i = 0;
my %seqno;

my %isagent = map { ($_, 1) } @agents;

while (<>) {
        next unless m{$instre}ogc; my $inst = $1;
        next unless m{$cmdpidre}ogc; my $command = $1; my $pid = $2;

        if ($command eq "smtpd") {
                if (m{\Gconnect from }gc) {
                        # Start new log
                        $smtpd{$pid}->{"log"} = $_; next;
                }

                $smtpd{$pid}->{"log"} .= $_;

                if (m{\G(\w+): client=}gc) {
                        # Fresh transaction 
                        my $qid = "$inst/$1";
                        $smtpd{$pid}->{"qid"} = $qid;
                        $transaction{$qid} = $smtpd{$pid}->{"log"};
                        $seqno{$qid} = ++$i;
                        next;
                }

                my $qid = $smtpd{$pid}->{"qid"};
                $transaction{$qid} .= $_
                        if (defined($qid) && exists $transaction{$qid});
                delete $smtpd{$pid} if (m{\Gdisconnect from}gc);
                next;
        }

        if ($command eq "pickup") {
                if (m{\G(\w+): uid=}gc) {
                        my $qid = "$inst/$1";
                        $transaction{$qid} = $_;
                        $seqno{$qid} = ++$i;
                }
                next;
        }

        # bounce(8) logs transaction start after cleanup(8) already logged
        # the message-id, so the cleanup log entry may be first
        #
        if ($command eq "cleanup") {
                next unless (m{\G(\w+): }gc);
                my $qid = "$inst/$1";
                $transaction{$qid} .= $_;
                $seqno{$qid} = ++$i if (! exists $seqno{$qid});
                next;
        }

        if ($command eq "qmgr") {
                next unless (m{\G(\w+): }gc);
                my $qid = "$inst/$1";
                if (defined($transaction{$qid})) {
                        $transaction{$qid} .= $_;
                        if (m{\Gremoved$}gc) {
                                print delete $transaction{$qid}, "\n";
                        }
                }
                next;
        }

        # Save pre-delivery messages for smtp(8) and lmtp(8)
        #
        if ($command eq "smtp" || $command eq "lmtp") {
                $smtp{$pid} .= $_;

                if (m{\G(\w+): to=}gc) {
                        my $qid = "$inst/$1";
                        if (defined($transaction{$qid})) {
                                $transaction{$qid} .= $smtp{$pid};
                        }
                        delete $smtp{$pid};
                }
                next;
        }

        if ($command eq "bounce") {
                if (m{\G(\w+): .*? notification: (\w+)$}gc) {
                        my $qid = "$inst/$1";
                        my $newid = "$inst/$2";
                        if (defined($transaction{$qid})) {
                                $transaction{$qid} .= $_;
                        }
                        $transaction{$newid} =
                                $_ . $transaction{$newid};
                        $seqno{$newid} = ++$i if (! exists $seqno{$newid});
                }
                next;
        }

        if ($isagent{$command}) {
                if (m{\G(\w+): to=}gc) {
                        my $qid = "$inst/$1";
                        if (defined($transaction{$qid})) {
                                $transaction{$qid} .= $_;
                        }
                }
                next;
        }
}

# Dump logs of incomplete transactions.
foreach my $qid (sort {$seqno{$a} <=> $seqno{$b}} keys %transaction) {
    print $transaction{$qid}, "\n";
}