We have experienced a problem where an email was quarantined even though the sender was whitelisted by the recipient.  In looking at the logs it appears this may occur because the program must check the SFDB before the whitelist...

08/02/07 15:34:32:263 -- (1104) Connection from: 65.54.246.107  -  Originating country : United States
08/02/07 15:34:32:560 -- (1104) Resolving 65.54.246.107 - bay0-omc1-s35.bay0.hotmail.com
08/02/07 15:34:32:826 -- (1104) - SFDB filter match - relevance:12
08/02/07 15:34:32:826 -- (1104) 65.54.246.107 - Mail from: vigilante1@msn.com To: Renee.Dowlin@portofportland.com will be rejected
08/02/07 15:34:33:638 -- (2464) Mail from: xiYFUTHMy@tippicanoe.net
08/02/07 15:34:33:638 -- (2464) 66.29.125.218 - Mail from: xiYFUTHMy@tippicanoe.net To: lawrej@portptld.com will be rejected
08/02/07 15:34:33:857 -- (1104) Start virus scan
08/02/07 15:34:33:857 -- (3912) Connection from: 75.80.181.25  -  Originating country : United States
08/02/07 15:34:33:966 -- (1104) Starting quarantine procedures
08/02/07 15:34:33:966 -- (1104) Created thread (844) to add email to quarantine
08/02/07 15:34:33:998 -- (1104) Blacklist cache - Added 65.54.246.107 to limbo
08/02/07 15:34:33:998 -- (1104) Disconnect

 

the "vigilante1" email address was whitelisted for the recipient already when this quarantine occurred so it should have checked the whitelist first.......

 

We are on release 3.5.4.692

Edited by Terry

I don't think that those really apply.  The sender was whitelisted by the user by releasing email from quarantine weeks earlier....here is a log entry from several days earlier that shows the fact that the sender was whitelisted for this recipient

07/30/07 08:59:54:218 -- (3040) Bypassed all rules for: Renee.Dowlin@portofportland.com from vigilante1@msn.com ( AutoWhiteList Force Delivery)
07/30/07 08:59:54:281 -- (3040) Bypassed all rules for: sam.hartsfield@portofportland.com from vigilante1@msn.com

I am really think it must be the order of checking....

 

We have reports from our users indicating the same problem (build 700).  In researching this report, we think found a seemingly unrelated issue which may give the appearance of a whitelisted email not coming through. In situations where an email was addressed to several recipients and one or two had the sender whitelisted while the others did not, the email is sent to the whitelisted recipients (as it should be) but the email is also quarantined for ALL the recipients in the list instead of just those without a whitelist entry.

This gives the appearance of a previously whitelisted address being blocked when the user checks the quarantine later.

This situation is causing us a LOT of problems...!!!

Roy

The mail is

Edited by RBarrow

Roberto, here is what I have in that line

WL_AuthorizedTOEmailsFileName=
WL_AutoWhiteListForceDeliveryFileName=d:\program files\spamfilter\AutoWhiteListForceDelivery.txt

 

does this need to be changed?

Those files have now been emailed to you...in reading the previous posts I did notice that the line in our filters.ini that was for WL_AuthorizedTOEmailsFileName=
is blank...does the other line supercede that entry?

We've been looking thru several days of logfiles, and have found a bug in SpamFilter which could have caused the AutoWhiteListForceDelivery.txt to become corrupted.

The following log entries do point to a possible problem:

07/16/07 07:36:36:921 -- (3400) Exception occurred during FindMatchInStringList: Invalid pointer operation
07/16/07 07:36:36:953 -- (2528) Reloading file for tblWL_AutoWhiteListForceDelivery: AutoWhiteListForceDelivery.txt

We've fixed the bug in red above with build 3.5.4.705 that has just been uploaded in the registered user area of the website.

Please note that we are still not 100% certain that the above bug was indeed the cause for the AutoWhiteList corruption. We are currently examining the other logs to see if this issue occurred more than once.

Thank you for the support!
We just finished going thru your logs, and saw the exact same erros on the 9th, 11th, 16th and 18th.

In all cases the two events I mentioned in the above post in red and green occur within 10-50 milliseconds of each other. While we still cannot replicate the issue in the lab, I can confirm that there was a bug in the code isolation within SpamFilter that could have caused it to happen. As we found 5 instances (two of them on happened on the 11th), I'm at this point pretty certain that this bug should be what caused you to loose entries in the AutoWhiteListForceDelivery.txt file. Build 705 that we uploaded should have taken care of it.

Please do let us know if you see further problems, as when there's an error we can't duplicate in the lab, there's always a level of uncertainty that we cannot avoid.

Matt,

This issue is different from the one reported by Terry. We've however patched this one too, and the fix will be included in the next released build. Please contact us if you wish to receive this intermediate build privately.