How does this eval work? -> MIME_MISSING_BOUNDARY

["Casanova, Chase" <Ch...@rdu.com>]

I've been getting a few FP's from Outlook generated, usually forwarded, emails due to MIME_MISSING_BOUNDARY.  What is it looking for and not finding?

Thanks,
Chase Casanova
IT Specialist
RDU Airport Authority
chase.casanova@rdu.com

Re: How does this eval work? -> MIME_MISSING_BOUNDARY

[Mariano Absatz <sp...@lists.com.ar>]

Chase,

are you using SpamAssassin within MailScanner by chance? I've seen you in 
MailScanner list also...

I just hit that wall these days... 

Find in your MailScanner.conf the setting:
Max SpamAssassin Size =

FPs hitting MIME_MISSING_BOUNDARY are probably larger than this size (the 
full message, not the attachment).

In order to shorten SA processing, MailScanner truncates messages to the size 
in that setting before handling them to SA... when a message is a MIME 
Multipart _and_ is larger than that (a condition likely to happen) SA says it 
missed a MIME boundary because it did... the ending boundary was never read 
by SA.

I think you can set this to 0 to avoid using it.

If this thread continues, it should do so in MailScanner list, not in 
SpamAssassin's.

Regards.



El 11 May 2004 a las 14:11, Matt Kettler escribió:

> At 01:48 PM 5/11/2004, Casanova, Chase wrote:
> >I've been getting a few FP's from Outlook generated, usually forwarded, 
> >emails due to MIME_MISSING_BOUNDARY.  What is it looking for and not finding?
> 
>  From looking at the code, it will detect emails which contain a particular 
> mime boundary, but fails to contain a one, and only one, matching 
> terminating boundary ending in a double-dash. (note: if there are multiple 
> sections with the same boundary, there should still only be one terminating 
> boundary)
> 
>  From EvalTests.Pm this is where "state" is determined for each boundary. 
> It seems to set it to 1 each time it finds a start, and decrements it each 
> time it finds a terminator.
> 
>        foreach my $boundary (@boundary) {
>          if (/^--$boundary$/) {
>            $state{$boundary} = 1;
>            $ctype = $cte = $cd = $charset = $name = 0;
>            $where = 1;
>          }
>          if (/^--$boundary--$/) {
>            $state{$boundary}--;
>            $where = 0;
>          }
>        }
> 
> And then later in the same function it checks to make sure each detected 
> boundary has a state of 0. If it finds one with a non-zero state, it sets 
> mime_missing_boundary to 1.
> 
>    foreach my $str (keys %state) {
>      if ($state{$str} != 0) {
>        $self->{mime_missing_boundary} = 1;
>        last;
>      } 


--
Mariano Absatz
El Baby
----------------------------------------------------------
Make yourself at home! Clean my kitchen.

Re: How does this eval work? -> MIME_MISSING_BOUNDARY

[Matt Kettler <mk...@evi-inc.com>]

At 01:48 PM 5/11/2004, Casanova, Chase wrote:
>I've been getting a few FP's from Outlook generated, usually forwarded, 
>emails due to MIME_MISSING_BOUNDARY.  What is it looking for and not finding?

 From looking at the code, it will detect emails which contain a particular 
mime boundary, but fails to contain a one, and only one, matching 
terminating boundary ending in a double-dash. (note: if there are multiple 
sections with the same boundary, there should still only be one terminating 
boundary)

 From EvalTests.Pm this is where "state" is determined for each boundary. 
It seems to set it to 1 each time it finds a start, and decrements it each 
time it finds a terminator.

       foreach my $boundary (@boundary) {
         if (/^--$boundary$/) {
           $state{$boundary} = 1;
           $ctype = $cte = $cd = $charset = $name = 0;
           $where = 1;
         }
         if (/^--$boundary--$/) {
           $state{$boundary}--;
           $where = 0;
         }
       }

And then later in the same function it checks to make sure each detected 
boundary has a state of 0. If it finds one with a non-zero state, it sets 
mime_missing_boundary to 1.

   foreach my $str (keys %state) {
     if ($state{$str} != 0) {
       $self->{mime_missing_boundary} = 1;
       last;
     }