Too Large or Too small or neither?????

Julian Field MailScanner at ecs.soton.ac.uk
Tue May 12 09:21:03 IST 2009


Look in /usr/lib/MailScanner/MailScanner/SweepContent.pm.
At or near line 308 you should find a line that looks like this:
     next if $safename =~ /^msg[-\d]+\.(txt|html)$/;
Change this to say
     next if $safename =~ /^.msg[-\d]+\.(txt|html)$/;
and the problem will be fixed.

Thanks for reporting it!
Note that to disable size checks, both the maximum and minimum should be 
set to -1.

Cheers,
Jules.

On 11/05/2009 20:20, Michael Masse wrote:
> Here are the queue files.     Thank you for looking into this.
>
> -Mike
>
>
>    
>>>> On 5/11/2009 at 1:18 PM, in message
>>>>          
> <EMEW3|1578b279d63beae45ec136dec276ac30l4AJIr0bMailScanner|ecs.soton.ac.uk|00060
> @ecs.soton.ac.uk>, Julian Field<MailScanner at ecs.soton.ac.uk>  wrote:
>    
>> The df file is only half the story, and is useless without its
>> corresponding qf file.
>> Please zip up a qf+df pair that shows this problem, and email me the zip
>> file.
>>
>> On 11/05/2009 18:44, Michael Masse wrote:
>>      
>>>> Julian Field wrote:
>>>>
>>>>
>>>>          
>>>>>>
>>>>>>              
>>>>> I'll need to take a look at this, and try a 0-byte attachment and see
>>>>> what happens.
>>>>> To disable the tests, set
>>>>> Maximum Attachment Size = -1
>>>>> Minimum Attachment Size = -1
>>>>>
>>>>> Please read the docs carefully and ensure you are setting the values
>>>>> appropriately.
>>>>> What is the precise case that you think it is handling incorrectly?
>>>>>
>>>>> Jules
>>>>>
>>>>>
>>>>>            
>>>> I don't think testing it with a 0 byte attachment will help much,
>>>> because a 0 byte attachment *should* get blocked when the min size is
>>>> set to 1.   The problem I'm having on 3 separate servers since upgrading
>>>> to 4.76 is that it's blocking on the attachment rule even when there is
>>>> no attachment.   I'm not exactly sure how to proceed because one part of
>>>> the error message says the attachment is too large, and another part
>>>> says it's too small.  Regardless there is no attachment so those errors
>>>> are just unintentional red herrings.  I have looked at numerous messages
>>>> in the quarantine and cannot find anything that gives away why it thinks
>>>> they have attachments to begin with.
>>>>
>>>> Like I said, I have been using MS for a number of years, have done
>>>> numerous upgrades, have had the min attachment size setting at the
>>>> default of 1 byte since it was available and have never had a problem
>>>> before upgrading to 4.76.   I just upgraded another server last night
>>>> and made sure it wasn't having this problem before the upgrade, and as
>>>> soon as I started MS after the upgrade it started having the same
>>>> problem.  I can provide more from the quarantine at pastbin.com if the
>>>> original data I posted is not enough.
>>>>
>>>> Oh, and again: MailScanner --lint says no errors.
>>>>
>>>>
>>>>
>>>>
>>>>          
>>> Latest Update:
>>>
>>> This problem really seems to me like a bug in 4.76.24-3.  I can reproduce
>>>        
>> this attachement size problem on every 4.76.24-3 system I can get my hands on
>> with a specific df/qf file combo that has NO attachment associated with it.
>> I've tried 3 more completely different systems with very different configs
>> and it always fails.   If I stick this same df/qf file pair into the
>> mqueue.in on any 4.74 or 4.75 system, it processes them correctly.
>>      
>>> I have posted a culprit df file at:
>>> http://pastebin.com/m216927c
>>>
>>> Even after trying to sanitize the user's real info, this very file will
>>>        
>> still cause an attachment size error.  If you look at the file, you can see
>> that there is nothing in it telling the system that there is an attachment
>> associated with the email, yet mailscanner still trips on it saying that the
>> attachment size is both too big and too small.
>>      
>>> The problem seems to be related to whitespace in the original file, because
>>>        
>> if I paste the text from that very pastebin back into a new df file, and then
>> send it through mqueue.in, it will process correctly.
>>      
>>> If you would like me to send an actual problematic df/qf file pair so you
>>>        
>> can reproduce this yourself, I would be more then willing to do so.
>>      
>>> Mike
>>>
>>>
>>>
>>>
>>>
>>>
>>>        
>> Jules
>>      
>
>
>
>    

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.



More information about the MailScanner mailing list