Noel,
I've fixed this by changing the MailImpl.java's implementation of the
duplicate method. It now also copies over the remote addr, remote host,
and last updated fields. This is probably serious enough that we'll
need to release again soon in case people are accidentally leaving open
relays.
--
Serge Knystautas
Loki Technologies - Unstoppable Websites
http://www.lokitech.com/
Noel J. Bergman wrote:
> Guys,
>
> I believe I have found the problem, and it is generic. In
> LinearProcessor.service() we have:
>
> if (notRecipients.size() != 0) {
> //There are a mix of recipients and not recipients.
> //We need to clone this message, put the notRecipients on
> the clone
> // and store it in the next spot
> MailImpl notMail = (MailImpl)mail.duplicate(newName(mail));
> notMail.setRecipients(notRecipients);
> unprocessed[i + 1].add(notMail);
> //We have to set the reduce possible recipients on the old
> message
> mail.setRecipients(recipients);
> }
>
> The salient point is mail.duplicate(newName(mail)). In
> MailImpl.duplicate(), we have:
>
> public Mail duplicate() {
> try {
> return new MailImpl(name, sender, recipients, getMessage());
> } catch (MessagingException me) {
> }
> return (Mail) null;
> }
>
> public Mail duplicate(String newName) {
> try {
> return new MailImpl(newName, sender, recipients, getMessage());
> } catch (MessagingException me) {
> }
> return (Mail) null;
> }
>
> We clone the name, sender, recipients and message, but NOT THE SENDING HOST.
> If you look at MailImpl, you'll see that remoteHost/remoteAddr defaults to
> localhost. In neither MailImpl nor LinearProcessor to we set the correct
> originating host. So when we split a message, we create messages
> originating from localhost, which therefore bypass the
> RemoteAddrNotInNetwork matcher, resulting an means to turn James into an
> open relay.
>
> The fix is to add
>
> notMail.setRemoteHost(mail.getRemoteHost());
> notMail.setRemoteAddr(mail.getRemoteAddr());
>
> immediately after notMail.setRecipients(notRecipients). I have tested it,
> and this does fix the problem.
>
> --- Noel
>
>
> --
> To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]>
> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
>
--
To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
