On Mon, Mar 06, 2006 at 02:23:51PM -0800, Alex Gottschalk wrote: > Jan Pieter Cornet wrote: > >On Mon, Mar 06, 2006 at 12:20:11PM -0800, Alex Gottschalk wrote: > >>Replacing the CRLF with a bare LF in these headers causes Clamav to no > >>longer quarantine these mail messages. > > > >I'm guessing something is doing double encoding tricks. When you > >pass lines ending in "CRLF" to the libraries, my guess is the > >libraries expect lines ending in "LF", and blindly replaces "LF" > >by "CRLF", so your lines end in "CRCRLF". Which is a bare CR > >followed by a line-ending, "CRLF". Bare CR characters are illegal > >in email. > > If that were the case, wouldn't I be seeing lines ending with ^M^M in > the quarantined email (as viewed with vi)? That isn't the case - the > MIME header lines end with a single ^M in mails that get quarantined.
Do you see all other mails ending with ^M? Why not? Surely all your other incoming mails follow the RFCs and are sent with CRLF line endings. (Note: You are supposed to answer this question to yourself, upon which you will hopefully see the light. Don't bother answering the obvious answer). Another note: if you're uncertain about the operations that certain tools make, try saving the mail just before it enters the mail system, and immediately after it becomes available from the milter, and inspect those files with a hex dump tool. Also, ethereal might be useful here. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disc lamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !! archive this message indefinately to allow verification of the logs. !! _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
