On Wed, 1 Aug 2001, Tabor J. Wells wrote:
> Re-read what I sent above. Rebuild your copy of Exim. Set
> DELIVER_OUT_BUFFER_SIZE=1024 in your Local/Makefile.
Yeah, I saw this, I was kinda hoping to avoid this, since I like
keeping Debian builds of exim because I trust it's more secure, but it
looks like this is what I'll end up doing. Maybe I'll snag the modified
exim debian source and recompile that, so I can keep all the nice
features of debian's exim, maybe a debian bug report should be in order.
And along the same lines, should exim's default DELIVER_OUT_BUFFER_SIZE be
lower to ensure comptiblity with stupid firewalls maybe?
> No, the requests to fragment are not getting to you. They are probably
That's odd, because since the PIX is limiting packets to no more than 2800
bytes (apparently), then you'd think the PIX would act accordingly and
send me the fragmentation requests, but I'm apparently you are correct
in saying I'm not receiving any fragmentation requests, looking back at my
tcpdump in my first post.
Either way, it's a firewall issue, and I can't expect to change every
single firewall config out there as you note. So might as well bite the
bullet and change the way exim is compiled per your suggestion.
> being blocked by the PIX with some sort of global deny of all ICMP rather
> than passing the types that tell you what size packets to send and
> blocking things like ICMP echo response traffic.
>
> You can work around this by building exim with a smaller
> DELIVER_OUT_BUFFER_SIZE as listed above. Or you can convince every
> misconfigured PIX admin that exhibits this problem with mail from your
> site to adjust their firewall configs. I went with the former because the
> latter was just becoming ridiculously hard to do.
Thanks for all your help.
+------------------------------------+-----------------------------+
| Stephen Grecni | /"\ |
| Hacker | \ / ASCII Ribbon Campaign |
| | X Against HTML E-Mail |
| Build your world. http://STEEM.com | / \ <!-- <HTML> --> |
+------------------------------------+-----------------------------+
