2017-12-14 09:56 UTC

View Issue Details Jump to Notes ]
IDProjectCategoryView StatusLast Update
0012393CentOS-7pythonpublic2017-11-21 14:39
Reporterdrencrom 
PrioritynormalSeveritymajorReproducibilityalways
StatusnewResolutionopen 
Product Version7.3.1611 
Target VersionFixed in Version 
Summary0012393: pypolicyd-spf fails decoding ip addresses
DescriptionWhen the policy-spf restriction is enabled in postfix using pypolicyd-spf-1.3.2-1.el7 there is an error for every incoming email that says:

'<ip_address>' does not appear to be an IPv4 or IPv6 address. Did you pass in a bytes (str in Python 2) instead of a unicode object?. Aborting whitelist processing.

The incoming email fails and the client server retries later.
Steps To ReproduceConfigure the policy-spf restriction in postfix using pypolicyd-spf-1.3.2-1.el7
TagsNo tags attached.
abrt_hash
URL
Attached Files

-Relationships
+Relationships

-Notes

~0028196

drencrom (reporter)

Just adding that this broke with the update of python-ipaddress to 1.0.16-2.el7

~0028254

techmsg (reporter)

Can confirm.

Dec 31 16:50:21 box policyd-spf[4336]: Traceback (most recent call last):
Dec 31 16:50:21 box policyd-spf[4336]: File "/usr/libexec/postfix/policyd-spf", line 700, in <module>
Dec 31 16:50:21 box policyd-spf[4336]: instance_dict, configData, peruser)
Dec 31 16:50:21 box policyd-spf[4336]: File "/usr/libexec/postfix/policyd-spf", line 412, in _spfcheck
Dec 31 16:50:21 box policyd-spf[4336]: res = spf.check2(ip, helo_fake_sender, helo, querytime=configData.get('Lookup_Time'))
Dec 31 16:50:21 box policyd-spf[4336]: File "/usr/lib/python2.7/site-packages/spf.py", line 297, in check2
Dec 31 16:50:21 box policyd-spf[4336]: receiver=receiver,timeout=timeout,verbose=verbose,querytime=querytime).check()
Dec 31 16:50:21 box policyd-spf[4336]: File "/usr/lib/python2.7/site-packages/spf.py", line 378, in __init__
Dec 31 16:50:21 box policyd-spf[4336]: self.set_ip(i)
Dec 31 16:50:21 box policyd-spf[4336]: File "/usr/lib/python2.7/site-packages/spf.py", line 405, in set_ip
Dec 31 16:50:21 box policyd-spf[4336]: self.ipaddr = ipaddress.ip_address(i)
Dec 31 16:50:21 box policyd-spf[4336]: File "/usr/lib/python2.7/site-packages/ipaddress.py", line 163, in ip_address
Dec 31 16:50:21 box policyd-spf[4336]: ' a unicode object?' % address)
Dec 31 16:50:21 box policyd-spf[4336]: AddressValueError: '2607:f8b0:4002:c05::232' does not appear to be an IPv4 or IPv6 address. Did you pass in a bytes (str in Python 2) instead of a unicode object?

~0028599

brad2014 (reporter)

Just for the record:
Corresponds to https://bugzilla.redhat.com/show_bug.cgi?id=1230373
Fixed in F22 a year ago. https://bodhi.fedoraproject.org/updates/FEDORA-2015-87253fc4b9
Still broken in CentOS 7.

~0028636

giesen (reporter)

For what it's worth I've added a COPR repo of the Perl equivalent that can be used as a substitute in the meantime.

https://copr.fedorainfracloud.org/coprs/giesen/postfix-policyd-spf-perl/

~0029078

CoaxVex (reporter)

I believe this issue arrises when you have python-ipaddress installed. (I have it as a dependency for certbot)
I got around it by creating a python virtualenv and installing pypolicyd-spf inside (and not the python ipaddress module)

Here is my ansible shizzle:

---
- name: Packages
  yum: name={{ item }}
  with_items:
  - python-pip
  - python-virtualenv

- name: Install pypolicyd-spf with pip
  pip:
    name: pypolicyd-spf
    virtualenv: /opt/pypolicyd-spf_env
    version: 1.3.2

- name: Install pypolicyd-spf dependencies
  pip:
    name: "{{ item }}"
    virtualenv: /opt/pypolicyd-spf_env
  with_items:
    - ipaddr
    - pydns


And I have this in my master.cf:

policyd-spf unix - n n - 0 spawn user=nobody
  argv=/opt/pypolicyd-spf_env/bin/python /opt/pypolicyd-spf_env/bin/policyd-spf

~0029623

vermeiremathias (reporter)

my fix:
use python3

yum install python34
yum install python34-setuptools
easy_install-3.4 pip
pip3 install pyspf
pip3 install py3dns
pip3 install pypolicyd-spf

change python3 path in /etc/postfix/master.cf
e.g.
policyd-spf unix - n n - 0 spawn user=nobody argv=/usr/bin/python3 /usr/libexec/postfix/policyd-spf

I hope this will help someone out there.

~0030190

MrCarrot (reporter)

I had this issue yesterday after installing Certbot (and thus the python-ipaddress dependency).

I had to disable SPF checking at first in Postfix.

However Vermeiremathias' solution above worked, installing Python3 alongside Python2.

Thank you!

~0030478

papundekl (reporter)

There is new version of this package - pypolicyd-spf-1.3.2-2.el7 in epel repo now with python-ipaddress package added as dependency! Could please someone confirm it's absolutely necessary? (I'm not capable of that) If not who should I write to to remove this nonsense? I don't like the idea of installing the whole new version of python just because of last digit version change. Thanks a lot.

============================================================================================
 Package Arch Version Repository Size
============================================================================================
Updating:
 pypolicyd-spf noarch 1.3.2-2.el7 epel 44 k
Installing for dependencies:
 python-ipaddress noarch 1.0.16-2.el7 base 34 k

Transaction Summary
============================================================================================
Install ( 1 Dependent package)
Upgrade 1 Package

Total download size: 79 k
Is this ok [y/d/N]:

~0030479

papundekl (reporter)

And yes, it breaks things just like before.

~0030486

Yohei TOMIYAMA (reporter)

After updating pypolicyd-spf as papundekl did, I dealt with this problem as follows.
However, the condition is that there are no dependent packages of python-ipaddress other than pypolicyd-spf.

 (1) rpm -e --nodeps python-ipaddress
 (2) vi /usr/libexec/postfix/policyd-spf
 (3) I change the following line (around line 40) as follows.
       - import ipaddress
       + import ipaddr as ipaddress.

I hope this will help.

~0030515

papundekl (reporter)

Check and test please: https://bugzilla.redhat.com/show_bug.cgi?id=1406941

~0030530

vanoc (reporter)

Yohei TOMIYAMA, works, thx!

~0030533

rjmco (reporter)

Thank you both Yohei for the workaround and Bojan (https://bodhi.fedoraproject.org/users/bojan) for the fixed package.

Please test the fixed package referenced on https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-aded0ed528 , register and give positive karma. The package needs one more karma point to get it included in the stable repository.

~0030623

rjmco (reporter)

pypolicyd-spf-1.3.2-5.el7 and python-pyspf-2.0.11-5.el7 have made it to the stable repo 4 days ago as verified on:

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-aded0ed528
http://dl.fedoraproject.org/pub/epel/7Server/x86_64/Packages/p/pypolicyd-spf-1.3.2-5.el7.noarch.rpm
http://dl.fedoraproject.org/pub/epel/7Server/x86_64/Packages/p/python-pyspf-2.0.11-5.el7.noarch.rpm

This issue has been solved.
+Notes

-Issue History
Date Modified Username Field Change
2016-12-15 15:35 drencrom New Issue
2016-12-19 14:12 drencrom Note Added: 0028196
2016-12-31 17:31 techmsg Note Added: 0028254
2017-02-18 01:15 brad2014 Note Added: 0028599
2017-02-22 11:37 giesen Note Added: 0028636
2017-04-16 19:27 CoaxVex Note Added: 0029078
2017-07-07 14:10 vermeiremathias Note Added: 0029623
2017-09-24 08:32 MrCarrot Note Added: 0030190
2017-10-27 23:33 papundekl Note Added: 0030478
2017-10-27 23:35 papundekl Note Added: 0030479
2017-10-30 16:20 Yohei TOMIYAMA Note Added: 0030486
2017-11-03 01:51 papundekl Note Added: 0030515
2017-11-07 08:29 vanoc Note Added: 0030530
2017-11-07 21:13 rjmco Note Added: 0030533
2017-11-21 14:39 rjmco Note Added: 0030623
+Issue History