[Rspamd-Users] "cannot parse spamd" with exim after rspamd 3.8 -> 3.9 upgrade

[Olaf Hopp (SCC)]

On 7/16/24 10:55 AM, Vsevolod Stakhov wrote:
> On 16/07/2024 09:47, Vsevolod Stakhov wrote:
>> On 16/07/2024 07:21, Olaf Hopp (SCC) wrote:
>>> Hi folks,
>>>
>>> I upgraded my rspamd from 3.8 to 3.9.
>>> After that, about half of my emails trigger an exim line like
>>>
>>>          2024-07-15 11:22:00 xxxxx-xxxxx-xx spam acl condition: cannot parse spamd [127.0.0.1]:11333, output: 1
>>>
>>> in the exim log file and those mails go through unfiltered.
>>> I don't see any correlation with anything for mails passing successfully the rspamd
>>> and mails not passing the rspamd.
>>>
>>> The rspamd logs nothing for those mails triggering the "cannot parse spamd" message
>>> It's not a kind of timeouts, the message is triggered within 1 or 2 seconds after opening
>>> the wire for the sending system.
>>>
>>> Anyone seeing the same problem ?
>>> exim- and rspamd Config was not modified and worked fine with rspamd 3.8
>>> exim is the latest Debian 12 (bookworm) "4.96-15+deb12u5"
>>> rspamd is 3.9.0-1
>>>
>>> Regards,
>>> Olaf
>>>
>>> PS: Yes, I also ask this on the exim list
>>>        I'm not sure if this is an exim or rspamd problem
>>>        and also want to warn you before upgrading your rspamd to version 3.9
>>>
>>>
>>
>> Exim support of Rspamd is just broken I would say. Nobody actually takes care about legacy SA protocol support and nobody should (as we have JSON+HTTP or milter protocol being fully supported). In fact, we should have dropped SA protocol years ago as it will simplify maintenance of the HTTP parser.
>>
>> As a replacement we will provide dlfunc to integrate Exim with Rspamd, since we failed to convince Exim developers that Rspamd exists. And once it is ready we will drop SA protocol support completely. Hence, that dlfunc will be the only recommended way for integration.
> 
> 
> Also, please paste Rspamd logs for those messages, Exim logs are useless.


the cause of the problem was a combination of self written lua code for handling ham/spam-learning
and the commit https://github.com/rspamd/rspamd/commit/f0c4d32740df0019673bc706c6004373a2a39220
Calling task:learn in a symbol filter fails in version 3.9 if the mail is already in the category.
In version 3.8 the mail was just ignored and the error logged.

This also explains why just a part of mails bypassed the spam check.
These are those mails, where the decision was to learn them as spam or ham.
Meanwhile we have adapted our code and rspamd 3.9 runs fine with our setup.

Regards, Olaf

-- 
Karlsruher Institut für Technologie (KIT)
Scientific Computing Center (SCC)

Dipl.-Geophys. Olaf Hopp

Zirkel 2
Gebäude 20.20, Raum 158
76131 Karlsruhe

Telefon: +49 721 608-48009
E-Mail: Olaf.Hopp at kit.edu
Web: www.scc.kit.edu

Sitz der Körperschaft:
Kaiserstraße 12, 76131 Karlsruhe

KIT - Die Forschungsuniversität in der Helmholtz-Gemeinschaft

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5781 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.rspamd.com/pipermail/users/attachments/20240717/b0893f58/attachment.bin>