Mime Parsing

Thu Jun 26 01:20:36 EDT 2008

Judy Northrop wrote:
> Peter,
>
> Thanks for helping.
>
> Yes I did truncate the message.  I just looked at the delivered message,
> it appears to be properly terminated.  Here is the complete header and i
> will include the ending terminator. Also, word documents (filename.doc)
> seem to work ok, to date I am only having problems with pdf files.
>   
Well, at a glance my guess would be that the attachment is perfectly 
fine, but no mail app can see it because the main message header is 
malformed. For example, the main message header specifies a MIME version 
but has no Content-Type header. Then after the header separator there is 
a MIME boundary string that hasn't even been declared. From my 
recollection, this is a violation of the MIME RFCs. There is one header 
in there that is rather informative:

X-jathome-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
score=4.168,
        required 4, MISSING_HB_SEP 2.50, MISSING_HEADERS 0.19,
        MISSING_SUBJECT 1.34, TO_CC_NONE 0.13)

So it would seem that the spam check service found problems with the 
message as well. The MISSING_HB_SEP is particularly disturbing. If I had 
to guess what was going on I would say there is a poorly written client 
or script sending these, or some filtering layer is altering the message 
content due to bugs or bad choice of rules.

Peter

> Judy
>
>
>
> Return-Path: <goodyear.judy at gmail.com>
> Received: from blade1000.jathome.net ([unix socket])
>          by e4500.jathome.net (Cyrus v2.2.12) with LMTPA;
>          Wed, 25 Jun 2008 06:34:40 -0700
> X-Sieve: CMU Sieve 2.2
> Received: from blade1000 (localhost [127.0.0.1])
>         by blade1000.jathome.net (Postfix) with ESMTP id 86B2168CF
>         for <root at localhost>; Wed, 25 Jun 2008 06:34:18 -0700 (MST)
> Received: from pop.west.cox.net [68.6.19.2]
>         by blade1000 with POP3 (fetchmail-6.3.6)
>         for <root at localhost> (single-drop); Wed, 25 Jun 2008 06:34:18
> -0700 (MST)
> Received: from fed1rmimpi06.cox.net ([70.169.32.78])
>           by fed1rmmtai102.cox.net
>           (InterMail vM.7.08.02.01 201-2186-121-102-20070209) with ESMTP
>           id
> <20080625133659.LVMX28169.fed1rmmtai102.cox.net at fed1rmimpi06.cox.net>
>           for <asterope at cox.net>; Wed, 25 Jun 2008 09:36:59 -0400
> Received: from yx-out-1718.google.com ([74.125.44.152])
>         by fed1rmimpi06.cox.net with IMP
>         id iDdB1Z03r3GzhEq05DdDsk; Wed, 25 Jun 2008 09:37:14 -0400
> X-VR-Score: NA
> MIME-Version: 1.0
> X-jathome-MailScanner-Information: Please contact the ISP for more
> information
> X-jathome-MailScanner: Found to be clean
> X-jathome-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
> score=4.168,
>         required 4, MISSING_HB_SEP 2.50, MISSING_HEADERS 0.19,
>         MISSING_SUBJECT 1.34, TO_CC_NONE 0.13)
> X-jathome-MailScanner-SpamScore: ssss
> X-jathome-MailScanner-From: goodyear.judy at gmail.com
> Subject: {Spam?}
> X-Spam-Status: Yes
> Message-ID: <cmu-lmtpd-1111-1214400880-0 at e4500.jathome.net>
> Date: Wed, 25 Jun 2008 06:34:40 -0700
>
> ------=_Part_23627_8483441.1214401029804
> Content-Type: multipart/alternative; 
>         boundary="----=_Part_23628_23828759.1214401029804"
>
> ------=_Part_23628_23828759.1214401029804
> Content-Type: text/plain; charset=ISO-8859-1
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
>
> stolt
>
> ------=_Part_23628_23828759.1214401029804
> Content-Type: text/html; charset=ISO-8859-1
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
>
> stolt<br>
>
> ------=_Part_23628_23828759.1214401029804--
>
> ------=_Part_23627_8483441.1214401029804
> Content-Type: application/pdf; name=stolt.pdf
> Content-Transfer-Encoding: base64
> X-Attachment-Id: f_fhvysr5d0
> Content-Disposition: attachment; filename=stolt.pdf
>
> JVBERi0xLjMKJcX+69cKMzEgMCBvYmoKPDwgL0xpbmVhcml6ZWQgMSAvTCAzNDU3NjQgL0ggWyAx
> MTQ0IDIxNCBdIC9PIDMzIC9FIDE0MzQyOCAvTiAzIC9UIDM0NTAyNSA+PgplbmRvYmoKICAgICAg
> ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCnhyZWYK
>
>   " "
>   " "
> BYWlsZXIgPDwgL1NpemUgMzEgL0lEIFs8ODhiMjA1YTZhMjVhOGZiZTYxMDIyODQ3MzY5ZDM1Yzk+
> PDgyZDFiNzFhZWVkYTFkYWNkM2NkNjBiMmFjMDgwM2U0Pl0gPj4Kc3RhcnR4cmVmCjE2NgolJUVP
> Rgo=
> ------=_Part_23627_8483441.1214401029804--
>
>
>
>
>
> Judy Northrop wrote:
>   
>> I just joined this list with the hope of correcting a problem with my
>> mail.  I configured my Solaris 10/postfix system about 18 months ago and
>> recently started getting corrupt pdf files.  I began searching the list
>> archives but have not located and common thread.  My Imap configuration> is,
>>   
>>     
> Judy,
>
> A few questions. First, that base64 data at the end of your example, was 
> it really that truncated, or did you just include a few lines? I ask 
> because several crucial bits of information are missing. I would need to 
> see the main header of the message to see what the Content-Type and MIME 
> boundary strings are set to. From your example, it would appear that the 
> top level boundary string is "------=_Part_23627_8483441.1214401029804". 
> One MIME section with that boundary is a standard multipart with one 
> plain text and one html portion. Those parts have their own boundary 
> which is "----=_Part_23628_23828759.1214401029804". That boundary is 
> properly terminated. What I don't see is the closing marker for the 
> first boundary string (the one that ends with --). Have you looked at 
> the raw message file delivered by Postfix, and is that truncated?
>
> Peter
>
>   
>>> (Blocalhost> ver
>>>       
>> name       : Cyrus IMAPD
>> version    : v2.2.12 2005/02/14 16:43:51
>> vendor     : Project Cyrus
>> support-url: http://asg.web.cmu.edu/cyrus
>> os         : SunOS> os-version : 5.10
>> environment: Built w/Cyrus SASL 2.1.22
>>              Running w/Cyrus SASL 2.1.22
>>              Built w/Sleepycat Software: Berkeley DB 4.4.20: (January> 10, 2006)
>>              Running w/Sleepycat Software: Berkeley DB 4.4.20: (January> 10, 2006)
>>              Built w/OpenSSL 0.9.8d 28 Sep 2006
>>              Running w/OpenSSL 0.9.8d 28 Sep 2006
>>              CMU Sieve 2.2>              mmap = shared
>>              lock = fcntl>              nonblock = fcntl
>>              auth = unix>              idle = poll
>>
>> I am including a portion of received email, you can see something is not
>> parsing correctly.  Anyway if someone could point me in to some type of
>> resolution it would be appreciated.  
>>
>> Thanks - Judy
>>
>>
>>
>>
>> ------=_Part_23627_8483441.1214401029804> Content-Type: multipart/alternative; 
>> 	boundary="----=_Part_23628_23828759.1214401029804"
>>
>> ------=_Part_23628_23828759.1214401029804
>> Content-Type: text/plain; charset=ISO-8859-1
>> Content-Transfer-Encoding: 7bit
>> Content-Disposition: inline
>>
>> stolt
>>
>> ------=_Part_23628_23828759.1214401029804
>> Content-Type: text/html; charset=ISO-8859-1
>> Content-Transfer-Encoding: 7bit
>> Content-Disposition: inline
>>
>> stolt<br>
>>
>> ------=_Part_23628_23828759.1214401029804--
>>
>> ------=_Part_23627_8483441.1214401029804
>> Content-Type: application/pdf; name=stolt.pdf
>> Content-Transfer-Encoding: base64
>> X-Attachment-Id: f_fhvysr5d0
>> Content-Disposition: attachment; filename=stolt.pdf
>>
>> JVBERi0xLjMKJcX+69cKMzEgMCBvYmoKPDwgL0xpbmVhcml6ZWQgMSAvTCAzNDU3NjQgL0ggWyAx
>> MTQ0IDIxNCBdIC9PIDMzIC9FIDE0MzQyOCAvTiAzIC9UIDM0NTAyNSA+PgplbmRvYmoKICAgICAg
>>
>>     
>
> ----
> Cyrus Home Page: http://cyrusimap.web.cmu.edu/
> Cyrus Wiki/FAQ: http://cyrusimap.web.cmu.edu/twiki
> List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html
>
>   