You are viewing a plain text version of this content. The canonical link for it is here.
Posted to server-user@james.apache.org by J Malcolm <te...@malcolms.com> on 2005/03/07 23:53:57 UTC
Exceptions in IsInfected matcher
I am getting tons of exceptions in the IsInfected matcher. I've been
running it for several months.
I'm pretty sure I wasn't getting these errors when I first installed it.
But I'm not 100% certain.
I just discovered all of this in the logs. There are about 4 or 5 different
exceptions that keep
occurring. But they all
appear to be somewhat related to the same type of problem. This occurs
about ever 10 minutes or so.
But some email containing viruses are successfully getting flagged. Is this
a result of some latest
spammer hacking trick on the message formats?
Is there a fix for this? I'm running 2.2.0a17. I can't seem to find where
I got the IsInfected matcher
package to see if there are updated versions of it. Can someone point me to
that download site?
Here are a couple of representative log entries:
07/03/05 11:26:14 ERROR spoolmanager.root: Exception calling IsInfected:
Exception thrown;
nested exception is:
class javax.mail.MessagingException: Missing start boundary
javax.mail.MessagingException: Exception thrown;
nested exception is:
class javax.mail.MessagingException: Missing start boundary
at
org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:372)
at
org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342)
at
org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:
407)
at
org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322)
at
org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.j
ava:55)
at
org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
javax.mail.MessagingException: Missing start boundary
at javax.mail.internet.MimeMultipart.parse(MimeMultipart.java:297)
at
javax.mail.internet.MimeMultipart.getCount(MimeMultipart.java:159)
at
org.apache.james.transport.matchers.IsInfected.dumpPart(IsInfected.java:447)
at
org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:249)
at
org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342)
at
org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:
407)
at
org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322)
at
org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.j
ava:55)
at
org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
and:
----------------------------------------------------------------------------
---
07/03/05 10:58:57 ERROR spoolmanager.root: Exception calling IsInfected:
Exception thrown;
nested exception is:
java.io.IOException: Error in encoded stream, got 1
javax.mail.MessagingException: Exception thrown;
nested exception is:
java.io.IOException: Error in encoded stream, got 1
at
org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:372)
at
org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342)
at
org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:
407)
at
org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322)
at
org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.j
ava:55)
at
org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
java.io.IOException: Error in encoded stream, got 1
at
com.sun.mail.util.BASE64DecoderStream.decode(BASE64DecoderStream.java:148)
at
com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:53)
at
com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:78)
at java.io.FilterInputStream.read(Unknown Source)
at
org.apache.james.transport.matchers.IsInfected.dumpPart(IsInfected.java:490)
at
org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:249)
at
org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342)
at
org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:
407)
at
org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322)
at
org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.j
ava:55)
at
org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Exceptions in IsInfected matcher
Posted by Vincenzo Gianferrari Pini <vi...@praxis.it>.
Here it goes:
https://svn.apache.org/repos/asf/james/server/branches/branch_2_1_fcs/src/java/org/apache/james/transport/mailets/ClamAVScan.java
Ciao,
Vincenzo
J Malcolm wrote:
>Vincenzo,
>
>Thanks for the info. Looks like I need to move to ClamAV. But I'm not
>familiar with navigating James SVN source tree, etc. Is there a direct link
>to download the ClamAVScan matcher?
>
>Thanks.
>
>Jerry
>
>-----Original Message-----
>From: Vincenzo Gianferrari Pini [mailto:vincenzo.gianferraripini@praxis.it]
>Sent: Tuesday, March 08, 2005 4:01 AM
>To: James Users List
>Subject: Re: Exceptions in IsInfected matcher
>
>I wrote myself the IsInfected matcher, and there are no updated versions
>of it.
>
>The java.io.IOException you are getting are thrown by JavaMail and come
>from malformed messages, as viruses/spam may be.
>
>I don't have (for now) the intention to update the matcher, as I've
>switched to the new ClamAVScan mailet recently commited to James SVN
>(see http://wiki.apache.org/james/ClamAVScan and
>http://nagoya.apache.org/eyebrowse/ReadMsg?listName=james-dev@jakarta.apache
>.org&msgNo=12756),
>that gives to ClamAV the burden to deal with such malformed stuff, and
>that works pretty well.
>
>Vincenzo
>
>J Malcolm wrote:
>
>
>
>>I am getting tons of exceptions in the IsInfected matcher. I've been
>>running it for several months.
>>I'm pretty sure I wasn't getting these errors when I first installed it.
>>But I'm not 100% certain.
>>I just discovered all of this in the logs. There are about 4 or 5
>>
>>
>different
>
>
>>exceptions that keep
>>occurring. But they all
>>appear to be somewhat related to the same type of problem. This occurs
>>about ever 10 minutes or so.
>>But some email containing viruses are successfully getting flagged. Is
>>
>>
>this
>
>
>>a result of some latest
>>spammer hacking trick on the message formats?
>>
>>Is there a fix for this? I'm running 2.2.0a17. I can't seem to find where
>>I got the IsInfected matcher
>>package to see if there are updated versions of it. Can someone point me
>>
>>
>to
>
>
>>that download site?
>>
>>Here are a couple of representative log entries:
>>
>>
>>07/03/05 11:26:14 ERROR spoolmanager.root: Exception calling IsInfected:
>>Exception thrown;
>> nested exception is:
>> class javax.mail.MessagingException: Missing start boundary
>>javax.mail.MessagingException: Exception thrown;
>> nested exception is:
>> class javax.mail.MessagingException: Missing start boundary
>> at
>>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:372)
>> at
>>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342
>>
>>
>)
>
>
>> at
>>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java
>>
>>
>:
>
>
>>407)
>> at
>>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322
>>
>>
>)
>
>
>> at
>>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.
>>
>>
>j
>
>
>>ava:55)
>> at
>>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>>javax.mail.MessagingException: Missing start boundary
>> at javax.mail.internet.MimeMultipart.parse(MimeMultipart.java:297)
>> at
>>javax.mail.internet.MimeMultipart.getCount(MimeMultipart.java:159)
>> at
>>org.apache.james.transport.matchers.IsInfected.dumpPart(IsInfected.java:447
>>
>>
>)
>
>
>> at
>>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:249)
>> at
>>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342
>>
>>
>)
>
>
>> at
>>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java
>>
>>
>:
>
>
>>407)
>> at
>>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322
>>
>>
>)
>
>
>> at
>>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.
>>
>>
>j
>
>
>>ava:55)
>> at
>>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>>
>>and:
>>---------------------------------------------------------------------------
>>
>>
>-
>
>
>>---
>>
>>07/03/05 10:58:57 ERROR spoolmanager.root: Exception calling IsInfected:
>>Exception thrown;
>> nested exception is:
>> java.io.IOException: Error in encoded stream, got 1
>>javax.mail.MessagingException: Exception thrown;
>> nested exception is:
>> java.io.IOException: Error in encoded stream, got 1
>> at
>>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:372)
>> at
>>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342
>>
>>
>)
>
>
>> at
>>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java
>>
>>
>:
>
>
>>407)
>> at
>>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322
>>
>>
>)
>
>
>> at
>>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.
>>
>>
>j
>
>
>>ava:55)
>> at
>>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>>java.io.IOException: Error in encoded stream, got 1
>> at
>>com.sun.mail.util.BASE64DecoderStream.decode(BASE64DecoderStream.java:148)
>> at
>>com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:53)
>> at
>>com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:78)
>> at java.io.FilterInputStream.read(Unknown Source)
>> at
>>org.apache.james.transport.matchers.IsInfected.dumpPart(IsInfected.java:490
>>
>>
>)
>
>
>> at
>>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:249)
>> at
>>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342
>>
>>
>)
>
>
>> at
>>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java
>>
>>
>:
>
>
>>407)
>> at
>>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322
>>
>>
>)
>
>
>> at
>>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.
>>
>>
>j
>
>
>>ava:55)
>> at
>>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>>For additional commands, e-mail: server-user-help@james.apache.org
>>
>>
>>
>>
>>
>>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>For additional commands, e-mail: server-user-help@james.apache.org
>
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>For additional commands, e-mail: server-user-help@james.apache.org
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
RE: Exceptions in IsInfected matcher
Posted by J Malcolm <te...@malcolms.com>.
Vincenzo,
Thanks for the info. Looks like I need to move to ClamAV. But I'm not
familiar with navigating James SVN source tree, etc. Is there a direct link
to download the ClamAVScan matcher?
Thanks.
Jerry
-----Original Message-----
From: Vincenzo Gianferrari Pini [mailto:vincenzo.gianferraripini@praxis.it]
Sent: Tuesday, March 08, 2005 4:01 AM
To: James Users List
Subject: Re: Exceptions in IsInfected matcher
I wrote myself the IsInfected matcher, and there are no updated versions
of it.
The java.io.IOException you are getting are thrown by JavaMail and come
from malformed messages, as viruses/spam may be.
I don't have (for now) the intention to update the matcher, as I've
switched to the new ClamAVScan mailet recently commited to James SVN
(see http://wiki.apache.org/james/ClamAVScan and
http://nagoya.apache.org/eyebrowse/ReadMsg?listName=james-dev@jakarta.apache
.org&msgNo=12756),
that gives to ClamAV the burden to deal with such malformed stuff, and
that works pretty well.
Vincenzo
J Malcolm wrote:
>I am getting tons of exceptions in the IsInfected matcher. I've been
>running it for several months.
>I'm pretty sure I wasn't getting these errors when I first installed it.
>But I'm not 100% certain.
>I just discovered all of this in the logs. There are about 4 or 5
different
>exceptions that keep
>occurring. But they all
>appear to be somewhat related to the same type of problem. This occurs
>about ever 10 minutes or so.
>But some email containing viruses are successfully getting flagged. Is
this
>a result of some latest
>spammer hacking trick on the message formats?
>
>Is there a fix for this? I'm running 2.2.0a17. I can't seem to find where
>I got the IsInfected matcher
>package to see if there are updated versions of it. Can someone point me
to
>that download site?
>
>Here are a couple of representative log entries:
>
>
>07/03/05 11:26:14 ERROR spoolmanager.root: Exception calling IsInfected:
>Exception thrown;
> nested exception is:
> class javax.mail.MessagingException: Missing start boundary
>javax.mail.MessagingException: Exception thrown;
> nested exception is:
> class javax.mail.MessagingException: Missing start boundary
> at
>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:372)
> at
>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342
)
> at
>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java
:
>407)
> at
>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322
)
> at
>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.
j
>ava:55)
> at
>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>javax.mail.MessagingException: Missing start boundary
> at javax.mail.internet.MimeMultipart.parse(MimeMultipart.java:297)
> at
>javax.mail.internet.MimeMultipart.getCount(MimeMultipart.java:159)
> at
>org.apache.james.transport.matchers.IsInfected.dumpPart(IsInfected.java:447
)
> at
>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:249)
> at
>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342
)
> at
>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java
:
>407)
> at
>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322
)
> at
>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.
j
>ava:55)
> at
>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>
>and:
>---------------------------------------------------------------------------
-
>---
>
>07/03/05 10:58:57 ERROR spoolmanager.root: Exception calling IsInfected:
>Exception thrown;
> nested exception is:
> java.io.IOException: Error in encoded stream, got 1
>javax.mail.MessagingException: Exception thrown;
> nested exception is:
> java.io.IOException: Error in encoded stream, got 1
> at
>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:372)
> at
>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342
)
> at
>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java
:
>407)
> at
>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322
)
> at
>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.
j
>ava:55)
> at
>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>java.io.IOException: Error in encoded stream, got 1
> at
>com.sun.mail.util.BASE64DecoderStream.decode(BASE64DecoderStream.java:148)
> at
>com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:53)
> at
>com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:78)
> at java.io.FilterInputStream.read(Unknown Source)
> at
>org.apache.james.transport.matchers.IsInfected.dumpPart(IsInfected.java:490
)
> at
>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:249)
> at
>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342
)
> at
>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java
:
>407)
> at
>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322
)
> at
>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.
j
>ava:55)
> at
>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>For additional commands, e-mail: server-user-help@james.apache.org
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Exceptions in IsInfected matcher
Posted by Vincenzo Gianferrari Pini <vi...@praxis.it>.
I wrote myself the IsInfected matcher, and there are no updated versions
of it.
The java.io.IOException you are getting are thrown by JavaMail and come
from malformed messages, as viruses/spam may be.
I don't have (for now) the intention to update the matcher, as I've
switched to the new ClamAVScan mailet recently commited to James SVN
(see http://wiki.apache.org/james/ClamAVScan and
http://nagoya.apache.org/eyebrowse/ReadMsg?listName=james-dev@jakarta.apache.org&msgNo=12756),
that gives to ClamAV the burden to deal with such malformed stuff, and
that works pretty well.
Vincenzo
J Malcolm wrote:
>I am getting tons of exceptions in the IsInfected matcher. I've been
>running it for several months.
>I'm pretty sure I wasn't getting these errors when I first installed it.
>But I'm not 100% certain.
>I just discovered all of this in the logs. There are about 4 or 5 different
>exceptions that keep
>occurring. But they all
>appear to be somewhat related to the same type of problem. This occurs
>about ever 10 minutes or so.
>But some email containing viruses are successfully getting flagged. Is this
>a result of some latest
>spammer hacking trick on the message formats?
>
>Is there a fix for this? I'm running 2.2.0a17. I can't seem to find where
>I got the IsInfected matcher
>package to see if there are updated versions of it. Can someone point me to
>that download site?
>
>Here are a couple of representative log entries:
>
>
>07/03/05 11:26:14 ERROR spoolmanager.root: Exception calling IsInfected:
>Exception thrown;
> nested exception is:
> class javax.mail.MessagingException: Missing start boundary
>javax.mail.MessagingException: Exception thrown;
> nested exception is:
> class javax.mail.MessagingException: Missing start boundary
> at
>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:372)
> at
>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342)
> at
>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:
>407)
> at
>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322)
> at
>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.j
>ava:55)
> at
>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>javax.mail.MessagingException: Missing start boundary
> at javax.mail.internet.MimeMultipart.parse(MimeMultipart.java:297)
> at
>javax.mail.internet.MimeMultipart.getCount(MimeMultipart.java:159)
> at
>org.apache.james.transport.matchers.IsInfected.dumpPart(IsInfected.java:447)
> at
>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:249)
> at
>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342)
> at
>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:
>407)
> at
>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322)
> at
>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.j
>ava:55)
> at
>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>
>and:
>----------------------------------------------------------------------------
>---
>
>07/03/05 10:58:57 ERROR spoolmanager.root: Exception calling IsInfected:
>Exception thrown;
> nested exception is:
> java.io.IOException: Error in encoded stream, got 1
>javax.mail.MessagingException: Exception thrown;
> nested exception is:
> java.io.IOException: Error in encoded stream, got 1
> at
>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:372)
> at
>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342)
> at
>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:
>407)
> at
>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322)
> at
>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.j
>ava:55)
> at
>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>java.io.IOException: Error in encoded stream, got 1
> at
>com.sun.mail.util.BASE64DecoderStream.decode(BASE64DecoderStream.java:148)
> at
>com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:53)
> at
>com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:78)
> at java.io.FilterInputStream.read(Unknown Source)
> at
>org.apache.james.transport.matchers.IsInfected.dumpPart(IsInfected.java:490)
> at
>org.apache.james.transport.matchers.IsInfected.match(IsInfected.java:249)
> at
>org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:342)
> at
>org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:
>407)
> at
>org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:322)
> at
>org.apache.james.util.thread.ExecutableRunnable.execute(ExecutableRunnable.j
>ava:55)
> at
>org.apache.james.util.thread.WorkerThread.run(WorkerThread.java:90)
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>For additional commands, e-mail: server-user-help@james.apache.org
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org