tierpod / dmarc-report-converter

Convert dmarc reports from xml to human-readable formats
MIT License
223 stars 25 forks source link

Most dmarc reports from Comcast cannot be read #32

Closed vbaarda closed 3 months ago

vbaarda commented 1 year ago

I've seen this problem with most (but not all) reports from Comcast:

[INFO] performs a reverse lookups, this may take some time
[INFO] imap: connecting to server imap.gmail.com:993
[INFO] imap: found 1 messages, 0 unseen
[INFO] imap: found attachment: comcast.net!xxx.org!1679443200!1679529600.xml.gz
[INFO] imap: save attachment to: /Users/xxx/Downloads/dmarc/comcast.net!xxx.org!1679443200!1679529600.xml.gz
[ERROR] imap: unexpected EOF, skip
[INFO] files: found 1 input files in /Users/xxx/Downloads/dmarc
[ERROR] files: unexpected EOF in file /Users/xxx/Downloads/dmarc/comcast.net!xxx.org!1679443200!1679529600.xml.gz, skip
[ERROR] processFiles: reports list is empty

The error is happening here:

imap.go:
                _, err = io.Copy(f, p.Body)
                if err != nil {
                    log.Printf("[ERROR] imap: %v, skip", err)
                    continue
                }

My first thought was to update everything in go.mod, in case emersion had fixed it:

module github.com/tierpod/dmarc-report-converter

go 1.20

require (
    github.com/emersion/go-imap v1.2.1
    github.com/emersion/go-message v0.16.0
    github.com/hashicorp/logutils v1.0.0
    gopkg.in/yaml.v2 v2.4.0
)

require (
    github.com/emersion/go-sasl v0.0.0-20220912192320-0145f2c60ead // indirect
    github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594 // indirect
    golang.org/x/text v0.8.0 // indirect
)

But now imap.go no longer compiles:

impossible type switch case: mail.AttachmentHeader
    p.Header (variable of type "github.com/emersion/go-message/mail".PartHeader) cannot have dynamic type "github.com/emersion/go-message/mail".AttachmentHeader (method Add has pointer receiver)

I am not a go developer, so I'm rather stuck at this point. Any thoughts?

tierpod commented 1 year ago

Hello @vbaarda ! Thank you for report. Could you please attach such xml.gz file with problem for investigation?

vbaarda commented 1 year ago

Hi @tierpod ,

Here's the entire email attachment, including boundary markers:

--_=_swift_v4_1679569616_ff5b7f4f0bf85de1e4715557e5d25910_=_
Content-Type: application/gzip;
 name=comcast.net!centerpointutah.org!1679443200!1679529600.xml.gz
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename=comcast.net!centerpointutah.org!1679443200!1679529600.xml.gz

H4sIAAAAAAAAA41U0Y7aMBB85r4C8U5COLgeks/Xp35B+xwZZxNcEtuynbT9++7aJkcqWlVC4B1P
dnYmK9j7z6FfT+C8MvptUxW7zRq0NI3S3dvm29cv29fN+p0/sRagOQt55U8rlukc2ay8FYg7sMaF
eoAgGhEEQitmXFdrMQCXZpDCh0JDYOWMEgUGoXreDMLJrWgGpT+LHlzwxeKRxCJ+llENn/bb6uXT
6Xioqt1xK0EHcNYoHcYgLgWKsPKDTI/iWFA7obuovGJn6BT6wB6Hw/N+h3YSEi9BN/HquD+90BXV
1KRcdJkl7mwza3olf9V2PPfKXyCLG7Sg+cMx8x3RRHNVA3esTIcIedtGhH4JsNzBd5AYi421/wB8
QqwMvKKp6UBAazhW+E0jP5gPY5XGpUmd+ZEi8GZ0EmpleXV4LTDkosLP/ogy800kSjNqFGRlOkQs
i8Ak+hETi60pBuWt8SrQ0mijAc3fIZlDzq3wHi9zCNFly1vcAjLZJo3ykQi+kmSAqQbDVq3CHU38
C4gGXN06Mzx+EfeEvAUT9MZCgmgJ0X/hQZyqwvnOT3k9F7Q4xB/iTIzhUjvwYx/yNHfe/m854vZT
gxxOLnI80OMGGMevz5jQrUgxzUrsFt0s+VdLC1kv0RwfyB02j8W/55lfEq7t0jjR0qrhPs5/K78B
O6dZ94oEAAA=

--_=_swift_v4_1679569616_ff5b7f4f0bf85de1e4715557e5d25910_=_--

Please note that the attachment and the base64 encoding are fine. I can decode it with uudeview, openssl, and python (email.message.Message.get_payload())

tierpod commented 1 year ago

Yes, I see that attachment looks fine. Unfortunately, upgrading to last stable versions of emersion libraries didn't fix this problem. I can try to investigate it a little deeper, if you send me the whole email file (you can download eml file from gmail and attach it to this topic or sent to my email).

vbaarda commented 1 year ago

Hi @tierpod ,

I will send it to your email address. Nothing super private there, just some email addresses, but would rather not post it here. Subject line will be the URL of this issue. Thanks!

vbaarda commented 1 year ago

@tierpod

I no longer have an environment for testing the fix. You can close this issue if you wish.

tierpod commented 3 months ago

Looks like problem is gone after one more emersion packages update