<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16700"></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2 face=Arial>If this is causing an issue the fix would be in the unpackrar
function to test if the file is part of a multi-volume archive and not try and
extract the file. But this is the same as allowing multipart emails, I wouldn't
do it because there is no way to virus test a multipart attachment. Of course
there could be a new config option to allow multi-volume rar (or
maybe archives in general?) files that was rule based so you could
allow a file name pattern from your own users and disallow from all
else.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2 face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2 face=Arial>Testing for the multi-volume is fast and pretty easy. Command
line would be :</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2 face=Arial> /path/unrar lv FileName</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2 face=Arial>Output would be either </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2
face=Arial>-------------------------------------------------------------------------------<BR>
1 185500442 52428702
28% volume 1</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2
face=Arial> ^ ^
^ +-- Volume
Number</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2
face=Arial> | |
+ ----------- The Word Volume </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2
face=Arial> |
+---------------------------------------- The size of this
file<BR>
+----------------------------------------------------- Total size of combined
volume</DIV></FONT></SPAN>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2 face=Arial>or</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2 face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011><FONT color=#0000ff
size=2
face=Arial>-------------------------------------------------------------------------------<BR>
0
0 52428702 0% volume
2</FONT></SPAN></DIV>
<DIV><SPAN class=711402116-25012011><FONT color=#0000ff size=2
face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=711402116-25012011><FONT color=#0000ff size=2 face=Arial>The
first number is 1 for the first part and zero for the others so if the file
size is known a regex (with all white space truncated to one char, no leading or
trailing)</FONT></SPAN></DIV>
<DIV><SPAN class=711402116-25012011><FONT color=#0000ff size=2
face=Arial> /^\d+\s\d+\s$FileSize\s\d+\%\svolume\s+$/, the
file size part is just insurance we don't hit the string somewhere in the
listing but really I think just adding</FONT></SPAN></DIV>
<DIV><SPAN class=711402116-25012011><FONT color=#0000ff size=2
face=Arial>another \d+ would suffice</FONT></SPAN></DIV>
<DIV><SPAN class=711402116-25012011><FONT color=#0000ff size=2 face=Arial>If
this regex hit (and could probably just change the $FileSize to another \d+) you
would know it was part of a multi-volume set.</FONT></SPAN></DIV>
<DIV><SPAN class=711402116-25012011><FONT color=#0000ff size=2 face=Arial>To me
this is an overly complicated change to accommodate a one off situation. Can you
not just enter pass in one of the file rules sets?</FONT></SPAN></DIV>
<DIV><SPAN class=711402116-25012011><FONT color=#0000ff size=2
face=Arial></FONT></SPAN> </DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=711402116-25012011>I am looking at the unrar code and as I thought the lv
is already used to check for password protection so</SPAN> <SPAN
class=711402116-25012011>changing the relevant part
to:</SPAN></FONT></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=711402116-25012011></SPAN></FONT></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=711402116-25012011> foreach $what (@test) {<BR>
#print STDERR "Processing \"$what\"\n";<BR> # If we haven't
hit any ------- lines at all, and we are prompted for<BR> # a
password, then the whole archive is password-protected.<BR>
unless ($BeginInfo || $EndInfo) {<BR> if ($what =~
/^Encrypted file:/i && !$allowpasswords)
{<BR>
MailScanner::Log::WarnLog("Password Protected RAR
Found");<BR> return
"password";<BR>
}</SPAN></FONT></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=711402116-25012011> if ($what =~
/^\s+\d+\s+\d+\s+\d+\s+\d+%\s+volume\s{0,}$/i)
{<BR>
MailScanner::Log::WarnLog("Multi-Volume RAR
Found");<BR> return
"multivolume";<BR> }<BR><BR>
}<BR></DIV></SPAN></FONT></FONT></FONT>
<DIV><SPAN class=711402116-25012011><FONT color=#0000ff size=2 face=Arial>This
would prevent MailScanner from attempting to unpack the file and if the return
is multivolume MS could handle it according to a configured setting, or default
to rejecting outright instead of trying until it hits maxfail and rejects
it.</FONT></SPAN></DIV>
<DIV><SPAN class=711402116-25012011><FONT color=#0000ff size=2
face=Arial></FONT> </DIV>
<DIV dir=ltr align=left><SPAN class=711402116-25012011></SPAN><FONT
color=#0000ff size=2 face=Arial>B<SPAN class=711402116-25012011>ack to
Julian</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Arial><SPAN
class=711402116-25012011></SPAN></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Arial><SPAN
class=711402116-25012011>Rick</SPAN></DIV>
<DIV dir=ltr align=left><BR></DIV></FONT></SPAN><BR>
<DIV dir=ltr lang=en-us class=OutlookMessageHeader align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>From:</B> mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <B>On Behalf Of </B>Curu
Wong<BR><B>Sent:</B> Tuesday, January 25, 2011 12:46 AM<BR><B>To:</B>
MailScanner discussion<BR><B>Subject:</B> multi-volume RAR archive
problem<BR></FONT><BR></DIV>
<DIV></DIV>Strictly speaking, I am not sure if this is a problem.<BR><BR>We can
create multi-volume(split volume) RAR archive with the WinRAR, and send them out
one by one via email. When one message arrives at MailScanner, it will try to
unpack that volume(part of the complete archive), which should definitely fail.
and then ms restart itself and try and fail and try and fail, then give up
processing that message, block it.<BR><BR>My question is, what's the better
solution? can we tell if a RAR archive is multi-volumed and just skip processing
it? Is it a good policy to restart ms itself(due to external failure) and do the
exact same(should always fail) action toward the offending message?<BR><BR>--
<BR>This message has been scanned for viruses and <BR>dangerous content by <A
href="http://www.mailscanner.info/"><B>MailScanner</B></A>, and is <BR>believed
to be clean. </BODY><br />--
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br />believed to be clean.
</HTML>