Hi Julian, please read this Mail (Part 1)

[Holger Gebhard]

Hi Julian,
hi Group...

Sorry for this long Mail, but no one of my Messages the Last time are
answered...
I postet two Problems... (Duplicated Warning in Report and Problem with
Rulefiles).
No other one seems to have similar Problems?

For the first Problem I have found a "temporarly" solution because i could
not found the actual problem.
The Duplicated Warnings in Reports can be found in the following Funktions:

Maximun Mesage Size
Maximum Attachments Per Message
Allow Partitial Messages
Block Encrypted Messages
Block Unencrypted Messages

All these Features are processed in SweepContent.pm (sub scanbatch,
except "Maximum Attachments Per Message" (in Message.pm, sub Explode).

One Example for "Maximum Message Size":

For the first I checked all Reportvalues in SweepConent.pm (Values
like "message->{otherreports}", etc).
Allways only one Reportword... Seems all to be OK for Sweepcontent.pm...
Then i checked the Reportwords in Message.pm... For the first i checked all
Values like "$text", etc. in "sub CombineReports". For this Values also
always only one Reportword.

Starting from "sub Clean" (for example the Value "$everyreport") the
Warning Messages are Duplicated...
So the Problem must be in "sub CombineReports"
So i checked this statements and loops:

---------------------------------------------
  # Now try to map all the reports onto their parents as far as possible
  #print STDERR "About to combine reports\n";
  my($key, $value, $parent, %foundparent);
  while(($key, $value) = each %reports) {
    $parent = $this->{file2parent}{$key};
    #print STDERR "Looking at report for $key (son of $parent)\n";
    if (defined $parent && exists($this->{safefile2file}{$parent})) {
      #print STDERR "Found parent of $key is $parent\n";
      $foundparent{$key} = 1;
      $this->{allreports}{$parent} .= $value;
      $this->{alltypes}{$parent}   .= $types{$key};
    }
  }
  # And delete the records for members we have found.
  #foreach $key (keys %foundparent) {
  #  print STDERR "Deleting report for $key\n";
  #  delete $this->{allreports}{$key};
  #  delete $this->{alltypes}{$key};
  #}

  # Now look for the reports we can't match anywhere and make them
  # map to the entire message.
  while(($key, $value) = each %reports) {
    if (defined $foundparent{$key} && !exists($this->{safefile2file}
{$key})) {
      #print STDERR "Promoting report for $key\n";
      delete $this->{allreports}{$key};
      delete $this->{alltypes}{$key};
      $this->{allreports}{""} .= $value;
      $this->{alltypes}{""} .= $types{$key};
    }
  }

  #print STDERR "Finished combining reports\n";
}

--------------------------------------------------

For the Example "Maximum Message Size" the Message matches the if statement:

if (defined $parent && exists($this->{safefile2file}{$parent})) {

I dont think this is the right statement?

According to my opinion a message over the Maximal Size should run in the
following if statement:

if (defined $foundparent{$key} && !exists($this->{safefile2file}{$key})) {

Ok... I tried to figure out why the Message runs in the first if
statement... After a few days i could not find why :-(

Then I tried a little trick...

Added some lines like the following:
---------------------------------------------

# Now try to map all the reports onto their parents as far as possible
  #print STDERR "About to combine reports\n";
  my($key, $value, $parent, %foundparent);
  while(($key, $value) = each %reports) {
    $parent = $this->{file2parent}{$key};
    #print STDERR "Looking at report for $key (son of $parent)\n";
    if (defined $parent && exists($this->{safefile2file}{$parent})) {
      #print STDERR "Found parent of $key is $parent\n";
      $foundparent{$key} = 1;
      $this->{allreports}{$parent} .= $value;
      $this->{alltypes}{$parent}   .= $types{$key};
    #if ($value =~ /Die maximale/) {
    if ($value eq MailScanner::Config::LanguageValue($this, 'toobig') ||
    MailScanner::Config::LanguageValue
($this, 'partialmessage') ||
    MailScanner::Config::LanguageValue
($this, 'toomanyattachments') ||
    MailScanner::Config::LanguageValue
($this, 'blockencrypted') ||
    MailScanner::Config::LanguageValue
($this, 'blockunencrypted')) {
    delete $this->{safefile2file}{$key};
    delete $this->{allreports};
    delete $this->{alltypes};
    }
    }
  }

---------------------------------------------

After my If statement for the Messages with "Duplicated Warnings"
no "{safefile2file}{$key}" is found and the message runs in the correct if
statement...

This Helps... No more Duplicated Warnings...

But i think this is only a "temporarly" solution... Can anybody figure out
where is the "real" problem?

Many thanks for help...


Holger



My System:

Debian
Postfix 2.0.19 (Split Queues)
MailScanner 4.30-3
SpamAssassin 2.63
RBLs, etc.

P.S. Also tried to solve the Problem with Postfix 2.1.1, Single Queue
Postfix and MailScanner 4.31-6... Nothing helps...

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html