Hi,
we found that this could be a solution?
diff -U5 /usr/sbin/amavisd-new.bak /usr/sbin/amavisd-new
--- /usr/sbin/amavisd-new.bak 2018-11-08 11:58:36.300181125 +0100
+++ /usr/sbin/amavisd-new 2018-11-08 11:50:58.262021510 +0100
@@ -31605,10 +31605,15 @@
} elsif (proc_status_ok($rv,$err, 3)) { # CRC_ERROR
# NOTE: password protected files in the archive cause CRC_ERROR
do_log(4,"do_unrar: CRC_ERROR - undecipherable, %s",
exit_status_str($rv,$err));
$part->attributes_add('U');
+ } elsif (proc_status_ok($rv,$err, 11)) { # ENCRYPT_ERROR
+ do_log(4,"do_unrar: maybe PROTECTED ARCHIVE - undecipherable, %s",
+ exit_status_str($rv,$err));
+ $part->attributes_add('U');
} elsif (proc_status_ok($rv,$err, 1) && @list && $bytes > 0) {
# WARNING, probably still ok
do_log(4,"do_unrar: warning, %s", exit_status_str($rv,$err));
} elsif (!proc_status_ok($rv,$err)) {
die("can't get a list of archive members: " .
Von: Grooz, Marc (regio iT)
Gesendet: Donnerstag, 8. November 2018 10:07
An: '[email protected]' <[email protected]>
Betreff: Encrypted rar
Hi,
I have a case where a encrypted rar archiv isn't blocked by amavis becouse the
filelist is also crypted.
For example:
(!)Decoding of p003 (RAR archive data, v6f,) failed, leaving it unpacked:
do_unrar: can't get a list of archive members: exit 11; 0 files
p.path [email protected]<mailto:[email protected]>: "P=p004,L=1,M=multipart/mixed
|
P=p003,L=1/2,M=application/x-rar-compressed,T=rar,N=twain_32_verschluesselt.rar",
matching_key="(?^:^\\.(zip|rar|arc|arj|zoo|7z)$)"
p003 1/2 Content-Type: application/x-rar-compressed, base64, size: 30206, SHA1
digest: 7a818f8ab8d5b1a97a3594367585b7f983b6db68, name:
twain_32_verschluesselt.rar
Blocking rar archives where the filelist isn't encrypted is no problem.
How could amavis block such archives without blocking all rar types?
Regards Marc
