[exim-dev] [Bug 2563] New connection type "kse" for the Kasp…

Top Page
Delete this message
Reply to this message
Author: admin
Date:  
To: exim-dev
Subject: [exim-dev] [Bug 2563] New connection type "kse" for the Kaspersky Scan Engine
https://bugs.exim.org/show_bug.cgi?id=2563

--- Comment #11 from Andrew Colin Kissa <andrew@???> ---
I am seeing an issue when i run the tests against the server script that there
are intermittent cases where the server is closing the connection too early.

When i use the AV endpoint itself i cannot pickup these issues. I have double
checked my code and cannot pick up and issue that could cause this.

Take this example dump, the server side issued the FIN before even sending
the verdict. Why would the server want to end the connection before sending the
">DETECT EICAR-Test-File" line. This is for the second test.

== tcpdump ==
A...A...POST /scanmemory HTTP/1.0
Content-Length: 524
X-KAV-ProtocolVersion: 1
X-KAV-Timeout: 120000


IP 127.0.0.1.vpnz > 127.0.0.1.50530: Flags [.], ack 100, win 512, options
[nop,nop,TS val 1091091887 ecr 1091091887], length 0
E..4.o@.@..R...........b.w..\.......m......
A...A...
IP 127.0.0.1.50530 > 127.0.0.1.vpnz: Flags [P.], seq 100:624, ack 1, win 512,
options [nop,nop,TS val 1091091887 ecr 1091091887], length 524
E..@l.@.@............b..\....w.......5.....
A...A...From MAILER-DAEMON Sun May 03 09:07:06 2020
X-Envelope-From: <eximbuild@???>
X-Envelope-To: userx@???
Received: from eximbuild (helo=test.ex)
    by myhost.test.ex with local-esmtp (Exim x.yz)
    (envelope-from <eximbuild@???>)
    id 1jV8iQ-0006PQ-Cl
    for userx@???; Sun, 03 May 2020 09:07:06 +0200
Date: Fri, 17 Dec 2004 14:35:01 +0100
Subject: message should be rejected
Message-Id: <E1jV8iQ-0006PQ-Cl@???>
From: CALLER_NAME <eximbuild@???>


due to the server response (above)

IP 127.0.0.1.vpnz > 127.0.0.1.50530: Flags [F.], seq 1, ack 100, win 512,
options [nop,nop,TS val 1091091887 ecr 1091091887], length 0
E..4.p@.@..Q...........b.w..\.......l......
A...A...
IP 127.0.0.1.vpnz > 127.0.0.1.50530: Flags [R], seq 4202109376, win 0, length 0
== end tcpdump ==

--
You are receiving this mail because:
You are on the CC list for the bug.