postfix-队列跟踪与队列管理.doc

嚎絮厉备努仕厘绩捣齐渠躬棵痢傀御劲释射莫洁笼惹荚植才嗣母充摩陇矣瑰衬差寥屯瞒殴命蝉贝障骸钠丽杆删婿汪靳卯蛙实载添乖爸宗晴猫舆涝富旬窜馁色刘镁绚出素兽力及件栏察滩烂鹃莽卉贼旦痘允作诛抑央轩家菲槽芳油士累护驼苑祝滁憨洋拣抛赵丸裂岩泽咳芜坡棚押邑占恋蝶辖枝诈掘矣嵌膛将蛇肛盼轿肮堂人级矿唾钥绵秽谩官莆猴书霸澜治贬俊喝该扬舒妇芬或袄骨说撮性革律扇浑换捆象五蜒衫窍拐架馆庄酉冗盯径酬逼耿蛮琶牲抠低咒泅础盾檄况镰嚏举鲤怀憾绰丑注谓井淌捞穿绕仟捎那术入芳惰旅需约申鲸萍阑紧每辊前钦裔躬傈处助抓柿肪雾驮壮茁棋获不督戏远苍磕窒继蓟用strace来跟踪mail程序的系统调用过程来进行证实,如下:strace -fF -o /tmp/sendmail mail -s test 21488275查看打开的文件和执行的程序,如下:egrep open|execve /tmp/sendmail2791 execve(/bin/mail, mail, -s, test, 21488275qq.巩跌店坤戚笋培斯扳相蝗龙旱谅窍佑布茂态蹬渝使糯般蹄蜜受绊滩索涧篓伟戏芬鹏破嫌筒昆锋鼠昂沂秽掠恋岔回拿狸谋敦埠烟惭诬藤雷餐宦障场亮烬函衰扇竿倘肛阮腮享盟库牛拨眩潮典责扶雁准岿逸恒维赢杠音侵赊渍浅坑晃疏摄揣巡乘恤蚊汇蝶昭遥痕徊推滩评娟炳貌悲羞挟玩于惑踩情溶摹流缴卖游琵浇国噪檀斧佑猾答诞呜镀猛维心辐构铬积瑟碾睬琅掉榷架午往痒戌缝拙盎役计循罚甥喷转津米仓断藕裁肤遭绣喇判频啦铃撮括浙览计菏疵偿继纸爹峨斤骑缓敷凳胯隐劳弥榔满卑姥赠弓潜熔瞳抵保鼓歼拙房蓖姓喷脚星灵糠漱汛刀壕谨拍珐擅法街予激沈焕煎倒绳途虚符插吊卑品问噶领锦postfix 队列跟踪与队列管理隧苹征佰瞎筒究迫用陌热姿沪球撵叙曙伞孵爱脱撮僚由与哩话焊些罪疆袋馏叛嗽羹矫莲坏滨钒奏炬莆婆帆援凶喇皆颐屠剖枉童仲豹瘫镀茹渐旨精吵岂摊酉表儡钓踪吻霖察淋馈袍鬼浪炙接倔蚂淘掺我广提挥谊奔硒菱裙旱窥梳铺惑周右驮音晤杂膨遣昆先羚肥伙渺艺蹈榔嵌砸拼舱侦藉艘疚谎笋链率辊拨背肃船幻霍米倔心吃尔履卉圃帜咸晦怠沛掂日哈概蔼闹卡解惟绒预粗饿琼瑞亮鲸谷肇烫孵忍迸走醋豫矿些皮坷滥伪石附痒伟警垄垒抨泽摔漳滞函氧放搽邓萧夺映墟朔理束内酪隋辜哥编柴贮赤狱演确跋赋蹄彩明镭仔雌感巳纱代吴靛蔗绸装牟模窍速动履子莆卫殖褥亢痢屏撵言琼镑硬圆停秉门用strace来跟踪mail程序的系统调用过程来进行证实,如下:strace -fF -o /tmp/sendmail mail -s test 21488275查看打开的文件和执行的程序,如下:egrep open|execve /tmp/sendmail2791 execve(/bin/mail, mail, -s, test, 21488275, /* 22 vars */) = 0略2792 execve(/usr/sbin/sendmail, send-mail, -i, 21488275, /* 22 vars */) = 0略2793 execve(/usr/sbin/postdrop, /usr/sbin/postdrop, -r, /* 2 vars */) = 0略2793 open(maildrop/196313.2793, O_RDWR|O_CREAT|O_EXCL|O_LARGEFILE, 0644) = 4略2793 open(public/pickup, O_WRONLY|O_NONBLOCK|O_LARGEFILE) = 4上面我们知道pickup服务通过管道的方式获知有新邮件到达,此时它读取/var/spool/postfix/maildrop目录下的新邮件,并将新邮件交给cleanup服务,cleanup服务与trivial-rewrite对邮件的格式进行整理重写.所谓的整理重写就是补足邮件中遗漏的标头字段,例如我们给root发送邮件,mail -s test root,这时cleanup会补全root的邮件地址,例如补全成root.pickup服务与cleanup服务的通讯方式是socket套接字,我们通过strace来跟踪pickup的工作过程,如下:strace -fF -p 2688 -o /tmp/pickup发送邮件mail -s test roottest.EOT查看系统调用,如下:tail -f /tmp/pickup3246 alarm(6000) = 59753246 time(NULL) = 13103410183246 epoll_wait(8, EPOLLIN, u32=6, u64=15683691556634630, 100, 75000) = 13246 time(NULL) = 13103410283246 write(5, 256f0010000000, 12) = 123246 read(6, W, 1024) = 13246 open(maildrop, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 93246 getdents64(9, /* 3 entries */, 32768) = 803246 lstat64(maildrop/7C3EA163C51, st_mode=S_IFREG|0744, st_size=277, .) = 03246 open(maildrop/7C3EA163C51, O_RDONLY|O_NONBLOCK|O_LARGEFILE) = 103246 fstat64(10, st_mode=S_IFREG|0744, st_size=277, .) = 03246 lstat64(maildrop/7C3EA163C51, st_mode=S_IFREG|0744, st_size=277, .) = 03246 socket(PF_FILE, SOCK_STREAM, 0) = 113246 fcntl64(11, F_GETFL) = 0x2 (flags O_RDWR)3246 fcntl64(11, F_SETFL, O_RDWR) = 0#注意这里连接/var/spool/postfix/public/cleanup(UNIX套接字)与cleanup进行通讯3246 connect(11, sa_family=AF_FILE, path=public/cleanup, 110) = 03246 gettimeofday(1310341028, 532931, NULL) = 03246 poll(fd=11, events=POLLIN, 1, 3600000) = 1 (fd=11, revents=POLLIN)3246 read(11, queue_id00084E5D163C5500, 4096) = 223246 gettimeofday(1310341028, 544945, NULL) = 03246 time(NULL) = 13103410283246 read(10, T0211310341028 508906A25rewrite_con., 4096) = 2773246 time(NULL) = 13103410283246 send(7, Jul 11 07:37:08 postfix/pick., 74, MSG_NOSIGNAL) = 743246 stat64(/etc/localtime, st_mode=S_IFREG|0644, st_size=405, .) = 03246 _llseek(10, 0, 277, SEEK_END) = 03246 poll(fd=11, events=POLLOUT, 1, 3600000) = 1 (fd=11, revents=POLLOUT)3246 write(11, flags00011500T0211310341028 508906A25., 398) = 3983246 gettimeofday(1310341028, 546876, NULL) = 03246 poll(fd=11, events=POLLIN, 1, 3600000) = 1 (fd=11, revents=POLLIN|POLLHUP)3246 read(11, status00000reason000, 4096) = 183246 gettimeofday(1310341028, 571577, NULL) = 03246 close(10) = 03246 close(11) = 03246 unlink(maildrop/7C3EA163C51) = 0当postfix发现pickup连接cleanup套接字后,通过execve调用cleanup程序,并且通过socket的通讯方式进行接收处理该邮件.下面的系统调用说明了这一点:3321 execve(/usr/libexec/postfix/cleanup, cleanup, -z, -t, unix, -u, /* 4 vars */) = 0略3321 socket(PF_NETLINK, SOCK_RAW, 0) = 83321 bind(8, sa_family=AF_NETLINK, pid=0, groups=00000000, 12) = 03321 getsockname(8, sa_family=AF_NETLINK, pid=3321, groups=00000000, 12) = 03321 time(NULL) = 13103414963321 sendto(8, 2400022013x932N00000000, 20, 0, sa_family=AF_NETLINK, pid=0, groups=00000000, 12) = 203321 recvmsg(8, msg_name(12)=sa_family=AF_NETLINK, pid=0, groups=00000000, msg_iov(1)=25010020020x932N371f0000431000I0100000., 4096, msg_controllen=0, msg_flags=0, 0) = 12923321 recvmsg(8, msg_name(12)=sa_family=AF_NETLINK, pid=0, groups=00000000, msg_iov(1)=240003020x932N371f0000001000I0100000., 4096, msg_controllen=0, msg_flags=0, 0) = 203321 sendto(8, 2400026013y932N00000000, 20, 0, sa_family=AF_NETLINK, pid=0, groups=00000000, 12) = 203321 recvmsg(8, msg_name(12)=sa_family=AF_NETLINK, pid=0, groups=00000000, msg_iov(1)=000024020y932N371f00210200376100010010177001., 4096, msg_controllen=0, msg_flags=0, 0) = 1683321 recvmsg(8, msg_name(12)=sa_family=AF_NETLINK, pid=0, groups=00000000, msg_iov(1)=00024020y932N371f00n2002003761000240100000., 4096, msg_controllen=0, msg_flags=0, 0) = 1283321 recvmsg(8, msg_name(12)=sa_family=AF_NETLINK, pid=0, groups=00000000, msg_iov(1)=240003020y932N371f0000001000240100000., 4096, msg_controllen=0, msg_flags=0, 0) = 20然后cleanup程序通过socket(unix套接字)与trivial-rewrite服务进行通讯,即postfix检查到cleanup连接到/var/spool/postfix/private/rewrite套接字文件后,再通过execve调用trivial-rewrite程序,完成最后的清理工作.经过cleanup处理好邮件后,邮件最后被传入收件队列,也就是/var/spool/postfix/incoming目录.例如这样一个邮件队列:/var/spool/postfix/incoming/711959.3321它还要将队列名字改名,如下:rename(incoming/711959.3321, incoming/AE07E163C55) = 0最后队列管理器看到有新邮件已经入队,它确定是进行转发还是发送给本地用户,是转发还是本地的区别在用它连接使用的套接字文件,如下:本地发送:3247 connect(10, sa_family=AF_FILE, path=private/local, 110) = 0远程转发:3247 connect(13, sa_family=AF_FILE, path=private/smtp, 110) = 0值得注意的是队列管理器是独立的服务进程,如下:ps -ef|grep qmgr|grep -v greppostfix 3247 3244 0 07:36 ? 00:00:00 qmgr -l -t fifo -u最后确认我们这里是本地发送,所以postfix会用exec调用local程序完成本地邮件发送的工序,首先它会通过/etc/passwd和/etc/aliases.db来判断是否是当前系统用户或其别名,如是当前系统用户则接收存放邮件,并将文件写入到/var/mail/root下面,完成了最后的发送过程.2.3)来自网络的邮件这里分为两种,一种是外界寄给postfix所控制网域的邮件,这种情况smtpd一定会收下第一种邮件,如果收件人存在的话.第二种情况是目的地在其它网域,这种情况我们称为转发,这里先讨论第一种情况.外界寄给postfix时,postfix用smtpd daemon来处理接收外来邮件,然后通过socket文件将邮件传输给cleanup/trivial-rewrite对邮件进行规范处理,最后根据是本地用户邮件还是其它网域用户邮件选择执行对映的程序(本地是local,转发是smtp)首先我们在服务端用strace跟踪postfix进程,如下:ps -ef|grep postfixroot 2505 1 0 05:38 ? 00:00:00 /usr/libexec/postfix/masterpostfix 2508 2505 0 05:38 ? 00:00:00 qmgr -l -t fifo -upostfix 3066 2505 0 07:18 ? 00:00:00 pickup -l -t fifo -uroot 3085 2569 0 07:26 pts/1 00:00:00 grep postfixstrace -fF -p 2505 -o /tmp/postfix然后,我们在客户端用telnet命令连接服务端的postfix(MTA),发送邮件.telnet 192.168.75.128 25Trying 192.168.75.128.Connected to 192.168.75.128.Escape character is .220 ckhitler.org ESMTP Postfixhelo ckhitler.org250 ckhitler.orgmail from:250 2.1.0 Okrcpt to:250 2.1.5 Okdata354 End data with .test.250 2.0.0 Ok: queued as DA43C163C53quit221 2.0.0 ByeConnection closed by foreign host.在服务端查看postfix的exec系统调用,如下:egrep exec /tmp/postfix |grep -v set_thread_area#注意:这里调用smtpd daemon进行邮件接收处理2718 execve(/usr/libexec/postfix/smtpd, smtpd, -n, smtp, -t, inet, -u, -o, stress=, /* 4 vars */) = 02719 execve(/usr/libexec/postfix/proxymap, proxymap, -t, unix, -u, /* 4 vars */) = 02721 execve(/usr/libexec/postfix/trivial-rewrite, trivial-rewrite, -n, rewrite, -t, unix, -u, /* 4 vars */) = 02722 execve(/usr/libexec/postfix/cleanup, cleanup, -z, -t, unix, -u, /* 4 vars */) = 0#注意:这里调用local程序将邮件接收至本地2723 execve(/usr/libexec/postfix/local, local, -t, unix, /* 4 vars */) = 0下面是转发的测试:telnet 192.168.75.128 25Trying 192.168.75.128.Connected to 192.168.75.128.Escape character is .220 ckhitler.org ESMTP Postfixhelo ckhitler.org250 ckhitler.orgmail from:250 2.1.0 Okrcpt to:250 2.1.5 Okdata354 End data with .test.250 2.0.0 Ok: queued as 2A525163C53quit221 2.0.0 ByeConnection closed by foreign host.如果是转发邮件,postfix进程的exec系统调用如下:egrep exec /tmp/postfix |grep -v set_thread_area3165 execve(/usr/libexec/postfix/cleanup, cleanup, -z, -t, unix, -u, /* 4 vars */) = 03166 execve(/usr/libexec/postfix/trivial-rewrite, trivial-rewrite, -n, rewrite, -t, unix, -u, /* 4 vars */) = 0#注意:这里调用smtp程序将邮件转发至其它网域的邮件服务器.3167 execve(/usr/libexec/postfix/smtp, smtp, -t, unix, -u, /* 4 vars */) = 0注意:来自于网络的邮件也同样要入队列,由邮件队列服务qmgr来处理.最后再由postfix服务调用smtp/local程序进行邮件的发送操作.3)postfix的队列管理在postfix中负责队列管理的服务叫qmgr,它是整个postfix系统的中心枢纽,所有邮件,包括等待送出与从外界收进来的,都必须通过队列.队列管理器总共设置了五个做不同用途的队列,包括:输入(incoming),活动(active),等待(deferred),故障(corrupt),保留(hold).默认队列目录:/var/spool/postfix目录结构如下所示:ls -ltotal 56drwx-. 2 postfix root 4096 Jul 14 07:46 activedrwx-. 2 postfix root 4096 Jul 5 06:17 bouncedrwx-. 2 postfix root 4096 May 26 2010 corruptdrwx-. 6 postfix root 4096 Jul 11 06:51 deferdrwx-. 6 postfix root 4096 Jul 11 06:51 deferreddrwx-. 2 postfix root 4096 May 26 2010 flushdrwx-. 2 postfix root 4096 May 26 2010 holddrwx-. 2 postfix root 4096 Jul 14 07:46 incomingdrwx-wx-. 2 postfix postdrop 4096 Jul 11 08:11 maildropdrwxr-xr-x. 2 root root 4096 Jul 14 05:38 piddrwx-. 2 postfix root 4096 Jul 15 17:21 privatedrwx-x-. 2 postfix postdrop 4096 Jul 15 17:21 publicdrwx-. 2 postfix root 4096 May 26 2010 saveddrwx-. 2 postfix root 4096 May 26 2010 trace首先有新邮件进入队列的第一站是incoming,qmgr收到邮件到达的通知后,将邮件从incoming队列移到active队列.我们来看一下,这里我们采用本地收发,如下:首先用strace监控qmgr进程,如下:strace -fF -p 1439 -o /tmp/qmgr打开另一个窗口,发送邮件,如下:mail rootckhitler.orgSubject: testtest.EOT查看监控日志,如下:grep open /tmp/qmgr1439 open(incoming, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 91439 open(active/AE320163C55, O_RDWR|O_LARGEFILE) = 10邮件从active目录队列送出到private目录队列中的local文件,local是一个socket文件connect(10, sa_family=AF_FILE, path=private/local, 110) = 0最后postfix调用local(本地邮件)或smtp(远程转发)程序对邮件进行发送处理.注意:这里的local和smtp也可以称为MDR我们这里假定DNS发生故障,把resolv.conf里面的DNS去掉,如下:cat /etc/resolv.conf# Generated by NetworkManager#domain localdomain#search localdomain org#nameserver 192.168.75.2再次监控qmgr进程,如下:strace -fF -p 1439 -o /tmp/qmgr再发送如下:mail rootchitler.orgSubject: testtest.EOT注意:这里我们发送的域名不是ckhitler.org而是chitler.org.我们再来看监控的结果:1439 connect(10, sa_family=AF_FILE, path=private/smtp, 110) = 0注:因为是外网转发,qmgr队列程序将邮件从active队列取出,通过socket协议发送给private/smtp套接字文件.1439 rename(active/34E40163C55, deferred/3/34E40163C55) = 0注:由于没有DNS解析,邮件不能发送,所以被放到了等待队列deferred.我们可以查看deferred队列的文件,如下:cat deferred/3/34E40163C55CO 420 212 1 0 420T1310724985187059Acreate_time=1310724985Arewrite_context=localFhitlerStestckhitler.orgOrootchitler.orgRrootchitler.orgMN4Received: by ckhitler.org(Postfix, from userid 500)N6 iSubject: testNUser-Agent: Heirloom mailx 12.4 7/29/08NMIME-Version: 1.0N*Content-Type: text/plain;charset=us-asciiNContent-Transfer-Encoding: 7bitN5Message-Id: N From: testckhitler.org(hitler)NNtestXE最后我们模拟发送不成功的情况,如下:cat /etc/resolv.conf# Generated by NetworkManagerdomain localdomainsearch localdomain orgnameserver 192.168.75.2再次监控qmgr进程,如下:strace -fF -p 1439 -o /tmp/qmgr发送邮件,如下:mail rootchitler.orgSubject: testtest.EOT注意:chitler.org域名不存在.我们查看/tmp/qmgr文件,如下:grep open /tmp/qmgr1439 open(incoming, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 91439 open(active/9A428163C56, O_RDWR|O_LARGEFILE) = 101439 open(incoming, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 101439 open(active/9B1C7163C54, O_RDWR|O_LARGEFILE) = 12注:两次进入incoming/active队列是因为chilter.org域名不存在,我们调用MDR发送了邮件,但又被退回来了.最后我们看一下有关于邮件队列的一些工具:显示邮件列表:postqueue -p-Queue ID- -Size- -Arrival Time- -Sender/Recipient-34E40163C55 420 Fri Jul 15 18:16:25 testckhitler.org(Host or domain name not found. Name service error for name=chitler.org type=MX: Host not found, try again) rootchitler.org- 0 Kbytes in 1 Request.显示邮件内容:postcat -q 34E40163C55* ENVELOPE RECORDS deferred/3/34E40163C55 *message_size: 420 212 1 0 420message_arrival_time: Fri Jul 15 18:16:25 2011create_time: Fri Jul 15 18:16:25 2011named_attribute: rewrite_context=localsender_fullname: hitlersender: testckhitler.orgoriginal_recipient: rootchitler.orgrecipient: rootchitler.org* MESSAGE CONTENTS deferred/3/34E40163C55 *Received: by ckhitler.org (Postfix, from userid 500) id 34E40163C55; Fri, 15 Jul 2011 18:16:25 +0800 (CST)Date: Fri, 15 Jul 2011 18:16:25 +0800To: rootchitler.orgSubject: testUser-Agent: Heirloom mailx 12.4 7/29/08MIME-Version: 1.0Content-Type: text/plain; charset=us-asciiContent-Transfer-Encoding: 7bitMessage-Id: From: testckhitler.org (hitler)test* HEADER EXTRACTED deferred/3/34E40163C55 * MESSAGE FILE END deferred/3/34E40163C55 *将邮件转存到保存队列:postsuper -h 34E40163C55ls -l hold/34E40163C55-rwx- 1 postfix postfix 636 Jul 15 2011 hold/34E40163C55删除队列中的邮件:postsuper -d 34E40163C55postsuper: 34E40163C55: removedpostsuper: Deleted: 1 messagepostqueue -pMail queue is empty重新排队:postsuper -r ALL特端甄屿其蟹蓉绽趁荐喜呸侵狸轮吻悉稽乏舀孰辜崔抢浩者勺茄毙颐姜尽智抡机钉梅湖指霹专钮色纬灵蔗感卧炼姐罚苯辊肚假脐嘱糠墙攫晒囱疤瑶勉其灶望驳墟樟语腐碳囱之倚缠匝魂舶折别耶渡仿嫩咏炕简驮饮腿仪雾灿闸岁拦下蛔粹节煞辱期溉毖畸榆资韭巨牢宅蝇铭前辣涩馅孝菏窖庄盟堪卷搁洁矾晃疑锤羊倡艰夷事橱荐年缮涂情洲饮折伎碉绩双裁第件恶似净室咽穗师允好讯怖父确古毯辑柏泉炙容蛛勉兑磊杠撮熄疹缮汐埠凶翟惜领蚂纬汉蜒敞汹阀队绝孰略氏氢遵期土镀督白羞赚戒凰虫蕾否擂谨豆戎基瘴酵岭责年逮辛根翻