Help - Search - Members
Full Version: Mixed DOS/Unix new lines after Linux qmail
Kaspersky Lab Forum > English User Forum > Protection for Small and Medium Businesses
Alexey Varchenko
Hi! We are testing following configuration with Linux qmail as a KAV-driven anivirus gateway, which later redirects clean emails to Exchange 2007 HUB server.
When KAV is turned on, it eventually adds CRLF into mail headers and such email looks like message without body (or with headers in the body) when it reaches Exchange mailbox.
When KAV is turned off, mailflow work as expected.

Checked KAV RPM version:
[root@t57qmailgwsn01 ~]# rpm -qa | grep kav4
kav4lms-5.6-38
and
kav4lms-5.6-26
hinote
please attach an example of such a message with all headers in plain text (eml) format
Alexey Varchenko
Hope it would help.
hinote
I can only see pairs of CRLF (0d 0a) in the message you attached, all of them are at the right places, no extra CRLF symbols between header fields, no single CR or LF symbols without corresponding pair... So the message you attached looks completely ok...
(as I can see with the
$ od -t a 1.log | less
command)

I mean, yes, a message can look like it has (some of) its header fields inside the body just because an extra CRLF were inserted somewhere. To help with an advice and in order to find out the reason I'd need to know where exactly additional extra CRLF are inserted... And I cannot see this from the message you attached - it looks just ok.


In the meantime, kindly check that your KAV configuration does not contain any Windows-style line feeds that can be used by KAV as a part of the text inserted into headers thus producing extra CRLFs...


regards,
Andrey
Alexey Varchenko
QUOTE(hinote @ 10.03.2009 22:43) *
I can only see pairs of CRLF (0d 0a) in the message you attached, all of them are at the right places, no extra CRLF symbols between header fields, no single CR or LF symbols without corresponding pair... So the message you attached looks completely ok...


OK, let me re-phrase the problem: letter having Linux-style line ends (LF=0a without CR=0d) is sent from mail client to qmail. If KAV is not turned on, the email delivered to Exchange and to target mailbox user. Everything is OK. All headers separated by LF (0a) only.

But if KAV has processed the email, headers have BOTH Linux LF (0a) (please check the first headers in my sample) and windows CRLF (0d 0a) line ends. And it leads to future problems on Exchange side.

The question is why KAV adds windows CRLF instead of LF as in existing headers? Can we override such behavior?
hinote
A similar issue with adding extra 0D symbols to the message headers by kav-qmail has been already reported and fixed. The fix will be available in the upcoming Critical Fix (kav4lms 5.6 CF1). Its technical release is currently planned for the end of March.
This known problem, however, was noticed with unix local delivery. I'm not sure that it's exactly the same case you've reported here. I can provide you the fixed version of the application before it's official release so that you'll be able to verify that your case is fixed as well.


By the way, according to RFC, the line delimiter for SMTP messages is the CR+LF sequence. Any bare LF or CF are considered as malformed symbols. D.J. Bernstein, the creator of qmail, is known as a strict standard purist, so I wonder how can you even send messages with bare LF symbols (see his special article on this issue: http://cr.yp.to/docs/smtplf.html). If the mail client converts bare LFs to standard CRLF pairs while sending the messages by SMTP to qmail, they should go further to Exchange in the same form via SMTP as well, so I just cannot imagine how can Exchange rely on this format at all... This case (transferring messages via SMTP) differs in this sence from local delivery where the delivery happens using unix native line feeds rather than SMTP standard CRLF pairs...

Anyway, I'd like you to verify the case on the next build.
Alexey Varchenko
Thanks for an update. I'd like to participate in the pre-build testing if possible. You can send it by email. We are running RHEL4.
BTW, we are also trying to understand how qmail works with LF instead of CRLF, which is clearly described in RFC.
Alexey Varchenko
We have tested the pre-built RPM you've gave me and it works as expected now.
Do you have a planned date for kav4lms 5.6 CF1 release?
Thanks.
hinote
The tech release is now planned for 27th or March, public release should take place in a week after that I guess.
Thanks for your report and verification efforts.
deobox
QUOTE(hinote @ 13.03.2009 15:10) *
The tech release is now planned for 27th or March, public release should take place in a week after that I guess.
Thanks for your report and verification efforts.


Hi there,

I have the same issue with the mail headers when using the latest version of kav4lms with qmail so can I have the beta you provided to Alexey?

I use RHEL 5 - contact email : deo-at-mail.bg

Thanks in advance
hinote
QUOTE(deobox @ 17.03.2009 13:28) *
Hi there,

I have the same issue with the mail headers when using the latest version of kav4lms with qmail so can I have the beta you provided to Alexey?

I use RHEL 5 - contact email : deo-at-mail.bg

Thanks in advance


hi,

It was just an intermediate version under testing rather than beta, so I would not like to distribute it wider,
it was sent to the topic author only for problem verificaton purposes.
I'll send you updated version just after its technical release (I hope now in just 1-2 weeks).
deobox
QUOTE(hinote @ 17.03.2009 14:10) *
hi,

It was just an intermediate version under testing rather than beta, so I would not like to distribute it wider,
it was sent to the topic author only for problem verificaton purposes.
I'll send you updated version just after its technical release (I hope now in just 1-2 weeks).



Well,

For me that means to install my old 5.5 release as I wont be able to work on it from next week till the end of next month.
Better old than nothing ...

Thanks anyway
Luc3945
QUOTE(hinote @ 17.03.2009 13:10) *
hi,

It was just an intermediate version under testing rather than beta, so I would not like to distribute it wider,
it was sent to the topic author only for problem verificaton purposes.
I'll send you updated version just after its technical release (I hope now in just 1-2 weeks).


I am having the same issue here. Any news about the release of the new 5.6 CF1 version?

Thanks.
hinote
It's been already released internally, so you can expect the public release pretty soon...
Please be patient.
Luc3945
QUOTE(hinote @ 8.04.2009 11:55) *
It's been already released internally, so you can expect the public release pretty soon...
Please be patient.


Hello,

I have now downloaded and installed the latest maintenance release (5.6-39) on a test server.
The headers are ok now, they have all LF (hex 0a) line ends.

If kaspersky adds warnings to the mail body (when a virus is detected), these lines contain CRLF as line ends.
My tests with Thunderbird as e-mail client gave problems showing these mails with the extra lines added by the CR. I have attached a test mail as it has been saved on the server.
There are lines with LF line endings as well als lines with CRLF line endings.
The templates have all LF line ends, so these are ok. Is there a way to have all mail messages have only unix style LF as line separator instead of mixed LF and CRLF ?


Regards,
Luc
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.