At 13:41 +0000 9/26/2001, Oliver Egginger wrote:
>Hello,
>Sorry to bore you again.
>
>
>Suresh Ramasubramanian wrote:
>> See, there are two reasons for headers getting that large -
>>
>> 1. A mail loop of some kind
>> 2. An attempted buffer overflow exploit (like a HELO of > 1024 characters)
>>
>
>
>Yesterday I configured (accidentally) a mail-loop between two mailservers.
>I found this in the exim_mainlog:
>2001-09-25 09:03:50 15lrsM-0003du-00 ** Too many "Received" headers -
>suspected mail loop
>2001-09-25 09:04:09 15lrsf-0003eV-00 ** Too many "Received" headers -
>suspected mail loop
>2001-09-25 09:04:27 15lrsx-0003f2-00 ** Too many "Received" headers -
>suspected mail loop
>2001-09-25 09:24:32 15lsCO-0003i0-00 ** Too many "Received" headers -
>suspected mail loop
>
>Thats a pleasant feature, I think.
>
>
>The compile-time option discussed here looks like this:
>HEADER_MAXSIZE="(1024*1024)"
>
>1024 * 1024 = 1048576
>
>Nice,
>but how should I interpret this ?
As the total number of bytes in all the headers in the message (before Exim
adds any, I think).
>
>Tamas TEVESZ wrote:
>> received_headers_max is not the _size_ but the _number_ of headers
>
>But in which period ??
>One second; one hour; one day ???
Not a time period. This one is the number of Received: headers in a
particular message. Since each (well behaved) server adds one as the
message flies by, this limit catches loops. [Your summer user has you
forward to his winter provider before asking the winter provider to stop
forwarding to you is a simple case...more than just a pair of servers can
be involved. Far too common. Sigh!]
In dealing with the quoted log entries above, you should look at the
addressee(s) in one of the messages, and see whether you're forwarding them
on...if so the other end is probably forwarding them back, but you could
see more than one other machine involved.
--John
--
John Baxter jwblist@??? Port Ludlow, WA, USA
