Re: news gateway malfunctioning?

Marc G. Fournier wrote:
> On Wed, 4 Mar 2009, Alvaro Herrera wrote:
>
>> Lately I have gotten a number of moderation request for -hackers and
>> other lists that look like the attached message. From the header it
>> looks to me like they are coming from the USENET gateway; I wonder
>> what's up with the "RCPT TO" stuff at the top of the body of the
>> message. Is the gateway getting confused by the mangling done by the
>> spam checker?
>
> I'm a bit lost here, so bare with me ...
>
> First question, I guess, is whether there are othe rmessages showing up
> that RCPT TO stuff, or is it just these types of 'spam' messages ... ?

As far as I can tell, it's only spam messages that are KOI8-R encoded.
Strangely no other spam message seems to suffer the same fate. Maybe
something is buggy in the usenet gateway path that gets confused by a
KOI8-R escape sequence or something, and ends up inserting an extra
carriage return.

> The oddness here is that it almost looks like someone manually connected
> to the smtp port and tried to inject the message manually ... and ended
> up injecting the 'formatted message' that has all the SMTP cmds embeded
> ...

Well, it's consistent enough that I doubt that's the case. I attach a
pair of messages here. As far as I can tell, they are both exactly the
same message, except that one was passed through the usenet gateway.

--
Alvaro Herrera http://www.CommandPrompt.com/
PostgreSQL Replication, Consulting, Custom Development, 24x7 support