Hangup on 4.46.2 when missing filename/filetype rules

[Wess Bechard]

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I came across this bug today and thought I would share it with all of
you.

While installing a new email system with MailScanner 4.46.2 and Postfix
2.1.5, I came across a bug when handling missing filetype and filename
configuration files for MailScanner.

To make a long bug report short, commenting out the filename and filetype
rules from the Mailscanner.conf, or simply configuring and using the
filename and filetype checks fixes the problem.  The only bug here is
that MailScanner reports that it is ignoring the missing files, and then
crashes and starts a mail check loop that runs forever.

If you would like to read the details, please continue below.


It seems that MailScanner writes warning to the log file that it is
skipping the filename and filetype checks, as it cannot find the files. 
This warning is the proper way to handle the missing files.

The problem is that after issuing a warning, MailScanner dies, and
restarts.

Example:

Message 5FA399E80F4.8A148 from 64.12.136.13 (scomp at aol.net) to eliquid.ca
is not spam, SpamAssassin (score=1.658, required 5, autolearn=disabled,
FAKED_UNDISC_RECIPS 0.56, HTML_MESSAGE 0.00, MIME_HTML_MOSTLY 0.28,
NO_REAL_NAME 0.18, URIBL_SBL 0.63)
Oct 13 11:49:22 email MailScanner[23356]: Spam Checks completed at 8525
bytes per second

Right here is where the child process has restarted...

Oct 13 11:49:23 email MailScanner[23356]: Virus and Content Scanning:
Starting
Oct 13 11:49:30 email MailScanner[23371]: MailScanner E-Mail Virus
Scanner version 4.46.2 starting...
Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file
etc-dir%/filename.rules.conf, skipping
Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file
etc-dir%/filetype.rules.conf, skipping
Oct 13 11:49:30 email MailScanner[23371]: Read 676 hostnames from the
phishing whitelist

This example also shows that MailScanner has indicated that it will skip
the filename/filetype rules.  You would naturally assume that MailScanner
should ignore anything else about these rules.


Since mail was looping through spam checks and dying, I turned on Debug
mode and found the problem by running check_mailscanner.

Right when MailScanner starts to process the checks, right after the
virus scanning, we find an error:

Can't use an undefined value as an ARRAY reference at
/opt/MailScanner/lib/MailScanner/Config.pm line 897.

Config.pm @ Line 875:

sub FilenameRulesValue {
  my($message) = @_;

  my($list, at filenamelist,$file,$listref, at totallist);

  # Get the list of filenames and split it
  $list = Value('filenamerules', $message);
  @filenamelist = split(" ", $list);

  # Now construct a list containing the concatenation of all the
allow-deny
  # rules
  #print STDERR "Filename rulesets are " . join(', ', @filenamelist) .
"\n";
  foreach $file (@filenamelist) {
    if (!exists($FilenameRules{$file})) {
      #print STDERR "Could not find filenamerules $file, forcing a
re-read.\n";
      # This filename has not been seen before, so compile it now.
      # Skip the file if it didn't exist, error already generated.
      next unless $FilenameRules{$file} =
ReadOneFilenameRulesFile($file);
    }
    $listref = $FilenameRules{$file};
    #print STDERR "listref = $listref\n";
    #print STDERR "listref = " . @{$listref} . "\n";
    push @totallist, @{$listref};         <--- Error occurs here
  }

  #print STDERR "Filename rules for message are\n" .
join("\n", at totallist) .
  #             "Filename rules for message ends.\n";
  return \@totallist;
}


Thanks folks.

Make sure to visit us on irc.freenode.net #mailscanner for the live
technical support community!


___________________________________________

Wess Bechard
Information Technology Manager
eliquidMEDIA International Inc.
Visit: www.eliquid.com
Office: 519.973.1930  -  1.800.561.7525
Fax: 519.253.0337
Cell: 519.791.9492
___________________________________________


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!