MailScanner cannot analyse tif files

[Gerard Cleary]

Hi there,

Our company has started receiving tif files from our parent company in Japan.
Unfortunately, MailScanner cannot analyse them and it produces a message:
“MailScanner: Could not analyze message”.

When I bypass MailScanner, the file gets delivered and when I run the “file” 
command I get the following output:
[gcle at msf ~]$ file XAM00011.tif
XAM00011.tif: TIFF image data, little-endian
[gcle at msf ~]$ file -i XAM00011.tif
XAM00011.tif: image/tiff

I have tried to get tif files bypassed by MailScanner using the following line 
in filename.rules.conf:     <allow    \.tif$   -    -> (without the diamond 
brackets of course and with the whitespace between fields all TABs) and a 
matching line in filetype.rules.conf:   <allow     TIFF    -     -> (same 
provisos as above).

Getting desperate, I put an entry into allow.filenames.rules: <From:  *@* 
\.tif> and an entry into allow.filetypes.rules: <From:    *@*  TIFF> (again, 
with the same provisos as above).

I still get the “couldn't analyze” message so I then asked for a sample of the 
tif file from our technical department who use these files in their work.

When I received it I ran the “file” command as usual and I got the following 
results:
[gcle at msf ~]$ file XAL00471.tif
XAL00471.tif: TIFF image data, big-endian
[gcle at msf ~]$ file -i XAL00471.tif
XAL00471.tif: image/tiff

It seems that once the file has been through the technical department, it is 
turned into a “big-endian” file and MailScanner has no problem with it at 
all.  (Our parent company in Japan use AS400 mainframes.)

I am using MailScanner 4.65.3 on Centos Release 4.4 and Sendmail 8.14.0.

I have tried having the MailScanner configuration “TNEF Expander” 
saying “internal” and then saying “/usr/bin/tnef” (with an accompanying 
maxsize setting many times greater than these tif files) but there is no 
change in the resulting message.

I have checked the archives for "endian" entries but the four entries that 
come up have "endian" as a minor detail.

I had thought that the “endian” bit format would be transparent to users 
because the operating systems were meant to “deal” with it but maybe I'm 
badly mistaken.

Does anybody know what the problem really is please and how I can get around 
it in MailScanner?  I can provide the two named files above if anybody 
thought that might be useful.

In the meantime, I have turned off all MailScanner checking of any eMail from 
our parent company but this is not our preferred option.

Gerard.
-- 
Gerard Cleary
Systems Administrator
SMC Pneumatics (Australia) P/L
Ph: +61 2 9354 8222

-- 
This email message and any related attachments are confidential and should
only be read by those persons to whom they were addressed. They may contain
copyright, personal or legally privileged information. If you are not the
intended recipient of this email, any use of this information is strictly
prohibited and it must be deleted from your system. Views expressed in this
message are the views of the sender and are not necessarily views of SMC
Corporation, or it's subsidiaries, except where the message expressly states
otherwise.
Any advice contained herein should be treated as preliminary advice only and
subject to formal written confirmation. Although this email and any
attachments are believed to be free of any virus or any other defect which may
cause damage or loss, it is the responsibility of the recipient to ensure that
they are virus-free. SMC accepts no liability for any loss or damage that may
occur as a result of the transmission of this email or its attachments to the
recipient.