[CLOSED] Re: Bad RFC822 field name ''

[Jérome MOLLIER PIERRET]

The answer of Karthikeyan, S.  below :

Dear Clive Eisen,

> write(2, "Bad RFC822 field name \'\'\n at /us"..., 86) = 86
>
>>
>> Mail::Internet seems to be the culprit, the message has a rouge
>> header field "-:" which crashes MailScanner.
>>
>> Working on a patch.
>>
> Do you have an eta
>
> Anything we can do to help?


Thanks to you, Clive and Brian PASSANTE and all others, that we have a
patch that fixes the header line "-:" in those spam messages. Headers
are read using Mail::Header instead of Mail::Internet, and the body
using Mail::Internet, instead of the previous technique wherein
Mail::Internet read in the while mail in a single pass. This may
increase the time to scan a mail, though in a negligible amount.

Please get the patched Qmail.pm and QMDiskStore.pm from
http://opencompt.com. The links are http://opencompt.com/QMDiskStore.pm
and http://opencompt.com/Qmail.pm.

If any of you have any trouble with this new version, please let me know.

cheers,
Karthikeyan, S.
--
S.Karthikeyan | Ph: +91 (0) 44 52166646 Fax: +91 (0) 44 52079957
Opencomputing Technologies | http://opencompt.com
Server Side E-Mail Protection.

Brian PASSANTE wrote:

> Hi,
>
>> I don't have the will to read (again) rfc822 or 2822, but, even when
>> -:
>> may be legal, the offending header lines must be:
>> [
>>
>>              Priority: Normal                               ]
>>
>> That is definitively rfc822 NON-compliant.
>
>
>
> I know that "-:" is rfc822 compliant but the perl lib Mail::Header is
> not agree with that :)
> I tested parsing a email with the perl lib with the "-:" header and it
> return the same rfc822 error.
> I find the origin a the error but I am unable to correct it.
>
> In the Header.pm of the Mailtools libs, the function :
> sub _tag_case
> {
> my $tag = shift;
> $tag =~ s/\:$//;
>
> join('-',
>     map { /^[b-df-hj-np-tv-z]+$|^(?:MIME|SWE|SOAP|LDAP)$/i
>         ? uc($_) : ucfirst(lc($_)) }
>              split('-', $tag));
> }
>
> When parsing, "-:" headers, it return "", and after when a check is done
> by :
> croak( "Bad RFC822 field name '$tag'\n")
> unless(defined $ctag && $ctag =~ /\A($FIELD_NAME|From )/oi);
>
> the error appear because nothing is not rfc compliant.
>
>
>
> About a tips:
> just comment the 210 & 211 ligne of the Header.pm :
> croak( "Bad RFC822 field name '$tag'\n")
> unless(defined $ctag && $ctag =~ /\A($FIELD_NAME|From )/oi);
>
> It is not so really bad, because, if Qmail receive a buggy headers mail,
> it refuses it so we don't have to really check the rfc.
> I test  it by injecting all my buggy mail, and everything is working
> fine.
>
> Have a nice day
>
> --
> Brian PASSANTE,
> Tomao groupe KPF
>
> -------------------------- MailScanner list ----------------------
> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> Before posting, please see the Most Asked Questions at
> http://www.mailscanner.biz/maq/     and the archives at
> http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html