Sorry forgot:
you'll need the assp.pl 16124 from
http://assp.cvs.sourceforge.net/viewvc/assp/assp2/test/
to support the right handling of STDOUT and STDERR with the latest
ASSP_AFC.pm 4.27.
Thomas
Von: Thomas Eckardt <thomas.ecka...@thockar.com>
An: ASSP development mailing list <assp-test@lists.sourceforge.net>
Datum: 04.05.2016 17:47
Betreff: Re: [Assp-test] [request] AFC and rar archives
Just published an update for ASSP_AFC 4.27 (version is still not changed)
at CVS. Several problem should be fixed - caused by uncleared variables.
How ever, I detected a really big problem for the RAR and 7z extension.
Both are using system executables - from where the output to STDOUT and
STDERR is captured by IRC::Run..
Both filehandles exists only one time in a perl process (all threads
together). If multiple workers are executing the command(s) at the same
time, the mixed or missing output on both filehandles will cause
missdetections. To prevent this, I had to implement a thread semphore to
serialize the command execution over all workers. This can lead in to a
performance impact, if many workers are configued. For the default 5 to 7
workers I don't expect performance problems.
Never the less, testing the current code is wanted. If the logic is fine
in the current version - exchanging the decompression engine would be
easy, if anyone gets a really nice idea to solve the problem.
Thomas
Von: aquilinux <aquili...@gmail.com>
An: ASSP development mailing list <assp-test@lists.sourceforge.net>
Datum: 03.05.2016 17:48
Betreff: Re: [Assp-test] [request] AFC and rar archives
Huston, we have a problem!
It seems that new AFC plugin is treating .csv files as archive.....
*May-03-16 17:29:16 [Worker_4] Info: analyzing compressed file
/opt/assp/tmp/zip_4_1462289356/ITS01_2016W18.csv at zip-level 0*
*May-03-16 17:29:16 [Worker_4] Warning: possibly virus infected file
(can't
extract archive) '/opt/assp/tmp/zip_4_1462289356/ITS01_2016W18.csv' - - *
*May-03-16 17:29:16 m1-89354-12457 [Worker_4] [TLS-in] [TLS-out]
[Attachment] 62.209.51.48 <clear_ad...@remote.tld> to: r...@local.tld SPAM
FOUND bad attachment 'ITS01_2016W18.csv' is a ' - the file extension:
'.csv' does not match the content based detected file type '''*
obviously csv is not a forbidden extention as attachment....
On Tue, May 3, 2016 at 1:59 PM, aquilinux <aquili...@gmail.com> wrote:
> 1) xz, lrz, lzma and 7z they all work:
>
> *May-03-16 13:47:40 [Worker_1] Warning: possibly virus infected file
> (can't extract archive) '/opt/assp/tmp/zip_1_1462276059/vir.7z' - - *
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND bad attachment 'vir.7z' is a ' - the file extension: '.xz' does
not
> match the content based detected file type '''*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND replaced bad attachment 'vir.7z' is a ' - the file extension:
'.xz'
> does not match the content based detected file type ''' with 'vir.txt'*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] *
>
> *May-03-16 13:47:40 [Worker_1] Warning: possibly virus infected file
> (can't extract archive) '/opt/assp/tmp/zip_1_1462276060/vir.lzma' - - *
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND bad attachment 'vir.lzma' is a ' - the file extension: '.lzma'
does
> not match the content based detected file type '''*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND replaced bad attachment 'vir.lzma' is a ' - the file extension:
> '.lzma' does not match the content based detected file type ''' with
> 'vir.txt'*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> attachment vir.tar.gz found for Level-1*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> using user based compressed attachment check*
>
> *May-03-16 13:47:39 [Worker_1] Warning: possibly virus infected file
> (can't extract archive) '/opt/assp/tmp/zip_1_1462276059/53ddc8.js.lrz' -
> - *
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND bad attachment '53ddc8.js.lrz' is a ' - the file extension: '.lrz'
> does not match the content based detected file type '''*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND replaced bad attachment '53ddc8.js.lrz' is a ' - the file
extension:
> '.lrz' does not match the content based detected file type ''' with
> '53ddc8.js.txt'*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> attachment 53ddc8.js.xz found for Level-1*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> using user based compressed attachment check*
>
> *May-03-16 13:47:39 [Worker_1] Warning: possibly virus infected file
> (can't extract archive) '/opt/assp/tmp/zip_1_1462276059/53ddc8.js.xz' -
- *
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND bad attachment '53ddc8.js.xz' is a ' - the file extension: '.xz'
does
> not match the content based detected file type '''*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND replaced bad attachment '53ddc8.js.xz' is a ' - the file
extension:
> '.xz' does not match the content based detected file type ''' with
> '53ddc8.js.txt'*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> attachment vir.7z found for Level-1*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> using user based compressed attachment check*
>
> but the message:
> *replaced bad attachment '53ddc8.js.lrz' is a ' - the file extension:
> '.lrz' does not match the content based detected file type ''' with
> '53ddc8.js.txt'*
> is barely understandable..... makes no sense...
>
> 2) tar.gz is detected as archive but assp stops processing the
archive...
> no further action is taken after this message and the tar.gz attachment
> goes to the inbox, untouched:
>
> *May-03-16 13:47:40 [Worker_1] Info: will detect executables in
compressed
> files*
> *May-03-16 13:47:40 [Worker_1] Info: analyzing compressed file
> /opt/assp/tmp/zip_1_1462276060/vir.tar.gz at zip-level 0*
> *May-03-16 13:47:40 [Worker_1] Info: looking for filetype in: .gz .emz*
> *May-03-16 13:47:40 [Worker_1] Info: found compressed file with type:
'gz'*
>
> On Tue, May 3, 2016 at 1:32 PM, Thomas Eckardt
<thomas.ecka...@thockar.com
> > wrote:
>
>> 7z - was my mistake - forgot it the regex
>>
>> File::Type does not know several formats - I'll have to fix them one by
>> one - the lz.... formats should be fixed
>>
>> please download the plugin again - the version is not changed
>>
>> Thomas
>>
>>
>>
>>
>>
>> Von: aquilinux <aquili...@gmail.com>
>> An: ASSP development mailing list <assp-test@lists.sourceforge.net>
>> Datum: 03.05.2016 12:43
>> Betreff: Re: [Assp-test] [request] AFC and rar archives
>>
>>
>>
>> actually, i tested rar since it's the only archive been used besides
zip.
>>
>> I did tests with 7z, lrz and lzma but the file is not detected as a
zip:
>>
>> *May-03-16 12:28:50 [Worker_2] Info: will detect executables in
compressed
>> files*
>> *May-03-16 12:28:50 [Worker_2] Info: analyzing compressed file
>> /opt/assp/tmp/zip_2_1462271330/vir.7z at zip-level 0*
>> *May-03-16 12:28:50 [Worker_2] Info: looking for filetype in: .7z*
>> *May-03-16 12:28:50 [Worker_2] Info:
/opt/assp/tmp/zip_2_1462271330/vir.7z
>> seems not to be a compressed file*
>>
>> *May-03-16 12:28:50 [Worker_2] Info: will detect executables in
compressed
>> files*
>> *May-03-16 12:28:50 [Worker_2] Info: analyzing compressed file
>> /opt/assp/tmp/zip_2_1462271330/53ddc8.js.lrz at zip-level 0*
>> *May-03-16 12:28:50 [Worker_2] Info: looking for filetype in: .lrf .mar
>> .dist .distz .bpk .dump .deploy .lhx .saveme .buffer*
>> *May-03-16 12:28:50 [Worker_2] Info:
>> /opt/assp/tmp/zip_2_1462271330/53ddc8.js.lrz seems not to be a
compressed
>> file*
>>
>> *May-03-16 12:40:35 [Worker_2] Info: analyzing compressed file
>> /opt/assp/tmp/zip_2_1462272035/vir.lzma at zip-level 0*
>> *May-03-16 12:40:35 [Worker_2] Info:
>> /opt/assp/tmp/zip_2_1462272035/vir.lzma seems not to be a compressed
file*
>>
>>
>> On Tue, May 3, 2016 at 12:03 PM, Thomas Eckardt
>> <thomas.ecka...@thockar.com>
>> wrote:
>>
>> > >It works as expected.
>> >
>> > What have you tested?
>> >
>> > which executable?
>> > which compression formats?
>> >
>> > Thomas
>> >
>> >
>> >
>> >
>> >
>> > Von: aquilinux <aquili...@gmail.com>
>> > An: ASSP development mailing list
<assp-test@lists.sourceforge.net>
>> > Datum: 03.05.2016 12:01
>> > Betreff: Re: [Assp-test] [request] AFC and rar archives
>> >
>> >
>> >
>> > It works as expected.
>> > Thanks.
>> >
>> > On Tue, May 3, 2016 at 11:53 AM, aquilinux <aquili...@gmail.com>
wrote:
>> >
>> > > Hi Thomas, thanks for the release.
>> > > I'm testing it right now.
>> > >
>> > > On Tue, May 3, 2016 at 10:37 AM, Thomas Eckardt <
>> > > thomas.ecka...@thockar.com> wrote:
>> > >
>> > >> You may try ASSP_AFC.pm 4.27.
>> > >>
>> > >>
>> >
>> >
>>
>>
http://assp.cvs.sourceforge.net/viewvc/assp/assp2/Plugins/ASSP_AFC_V4_SMIME/
>>
>> >
>> > >>
>> > >> To support additionally decompression formats, you have to install
>> > >> Archive::Rar
>> > >> To support RAR decopression you need to install a rar or unrar
>> > executable
>> > >> in the PATH.
>> > >> To support various other decompression formats you need to install
a
>> > >> 7z,7za,7zip or p7zip executable in the PATH.
>> > >> For windows the required executables are included in the ppm
>> installer
>> > for
>> > >> Archive::Rar at the ASSP2 repo.
>> > >>
>> > >> Thomas
>> > >>
>> > >>
>> > >>
>> > >>
>> > >>
>> > >> Von: aquilinux <aquili...@gmail.com>
>> > >> An: ASSP development mailing list
>> <assp-test@lists.sourceforge.net>
>> > >> Datum: 28.04.2016 12:07
>> > >> Betreff: [Assp-test] [request] AFC and rar archives
>> > >>
>> > >>
>> > >>
>> > >> Hi Thomas, any chance in having assp processing rar archives?
>> > >>
>> > >> regards,
>> > >> aqx
>> > >>
>> > >> --
>> > >> "Madness, like small fish, runs in hosts, in vast numbers of
>> > instances."
>> > >>
>> > >> Nessuno mi pettina bene come il vento.
>> > >>
>> > >>
>> >
>> >
>>
>>
------------------------------------------------------------------------------
>> > >> Find and fix application performance issues faster with
Applications
>> > >> Manager
>> > >> Applications Manager provides deep performance insights into
multiple
>> > >> tiers of
>> > >> your business applications. It resolves application problems
quickly
>> > and
>> > >> reduces your MTTR. Get your free trial!
>> > >> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> > >> _______________________________________________
>> > >> Assp-test mailing list
>> > >> Assp-test@lists.sourceforge.net
>> > >> https://lists.sourceforge.net/lists/listinfo/assp-test
>> > >>
>> > >>
>> > >>
>> > >>
>> > >> DISCLAIMER:
>> > >> *******************************************************
>> > >> This email and any files transmitted with it may be confidential,
>> > legally
>> > >> privileged and protected in law and are intended solely for the
use
>> of
>> > the
>> > >>
>> > >> individual to whom it is addressed.
>> > >> This email was multiple times scanned for viruses. There should be
no
>> > >> known virus in this email!
>> > >> *******************************************************
>> > >>
>> > >>
>> > >>
>> > >>
>> >
>> >
>>
>>
------------------------------------------------------------------------------
>> > >> Find and fix application performance issues faster with
Applications
>> > >> Manager
>> > >> Applications Manager provides deep performance insights into
multiple
>> > >> tiers of
>> > >> your business applications. It resolves application problems
quickly
>> > and
>> > >> reduces your MTTR. Get your free trial!
>> > >> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> > >> _______________________________________________
>> > >> Assp-test mailing list
>> > >> Assp-test@lists.sourceforge.net
>> > >> https://lists.sourceforge.net/lists/listinfo/assp-test
>> > >>
>> > >>
>> > >
>> > >
>> > > --
>> > > "Madness, like small fish, runs in hosts, in vast numbers of
>> instances."
>> > >
>> > > Nessuno mi pettina bene come il vento.
>> > >
>> >
>> >
>> >
>> > --
>> > "Madness, like small fish, runs in hosts, in vast numbers of
instances."
>> >
>> > Nessuno mi pettina bene come il vento.
>> >
>> >
>>
>>
------------------------------------------------------------------------------
>> > Find and fix application performance issues faster with Applications
>> > Manager
>> > Applications Manager provides deep performance insights into multiple
>> > tiers of
>> > your business applications. It resolves application problems quickly
and
>> > reduces your MTTR. Get your free trial!
>> > https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> > _______________________________________________
>> > Assp-test mailing list
>> > Assp-test@lists.sourceforge.net
>> > https://lists.sourceforge.net/lists/listinfo/assp-test
>> >
>> >
>> >
>> >
>> > DISCLAIMER:
>> > *******************************************************
>> > This email and any files transmitted with it may be confidential,
>> legally
>> > privileged and protected in law and are intended solely for the use
of
>> the
>> >
>> > individual to whom it is addressed.
>> > This email was multiple times scanned for viruses. There should be no
>> > known virus in this email!
>> > *******************************************************
>> >
>> >
>> >
>> >
>>
>>
------------------------------------------------------------------------------
>> > Find and fix application performance issues faster with Applications
>> > Manager
>> > Applications Manager provides deep performance insights into multiple
>> > tiers of
>> > your business applications. It resolves application problems quickly
and
>> > reduces your MTTR. Get your free trial!
>> > https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> > _______________________________________________
>> > Assp-test mailing list
>> > Assp-test@lists.sourceforge.net
>> > https://lists.sourceforge.net/lists/listinfo/assp-test
>> >
>> >
>>
>>
>> --
>> "Madness, like small fish, runs in hosts, in vast numbers of
instances."
>>
>> Nessuno mi pettina bene come il vento.
>>
>>
------------------------------------------------------------------------------
>> Find and fix application performance issues faster with Applications
>> Manager
>> Applications Manager provides deep performance insights into multiple
>> tiers of
>> your business applications. It resolves application problems quickly
and
>> reduces your MTTR. Get your free trial!
>> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> _______________________________________________
>> Assp-test mailing list
>> Assp-test@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/assp-test
>>
>>
>>
>>
>> DISCLAIMER:
>> *******************************************************
>> This email and any files transmitted with it may be confidential,
legally
>> privileged and protected in law and are intended solely for the use of
the
>>
>> individual to whom it is addressed.
>> This email was multiple times scanned for viruses. There should be no
>> known virus in this email!
>> *******************************************************
>>
>>
>>
>>
------------------------------------------------------------------------------
>> Find and fix application performance issues faster with Applications
>> Manager
>> Applications Manager provides deep performance insights into multiple
>> tiers of
>> your business applications. It resolves application problems quickly
and
>> reduces your MTTR. Get your free trial!
>> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> _______________________________________________
>> Assp-test mailing list
>> Assp-test@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/assp-test
>>
>>
>
>
> --
> "Madness, like small fish, runs in hosts, in vast numbers of instances."
>
> Nessuno mi pettina bene come il vento.
>
--
"Madness, like small fish, runs in hosts, in vast numbers of instances."
Nessuno mi pettina bene come il vento.
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications
Manager
Applications Manager provides deep performance insights into multiple
tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications
Manager
Applications Manager provides deep performance insights into multiple
tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
