Hello!

On Wed, 21 Dec 2016 at 16:11:21 (+0200), Victor Cheburkin wrote:

> > Было правило и вроде работало (когда добавлял).

> > deny message = This message contains dangerous file(s) in 
> > ${uc:${extract{-1}{.}{$mime_filename}}} attachment.
> >     condition = ${if <{$message_size}{2500K}{1}{0}}
> >     condition = ${if 
> > match{$mime_filename}{\N(?i)\.(7z|arj|bz2|gz|rar|uue|z|zip|xz)$\N}}
> >     decode = default
> >     condition = ${if match{${run{/usr/local/bin/7z l 
> > $mime_decoded_filename}}} 
> > {\N(?i)\.(com|pif|scr|lnk|exe|js|zip|jar|bat|cmd)\n\N} }
> >     log_message = REJECTED: dangerous file in 
> > ${uc:${extract{-1}{.}{$mime_filename}}} attachment

> > Но сегодня пришел "злобный" вирус в письме с вложением "Новый.scr.uue"

> > ------=_NextPart_000_0A96_01D25B89.ECC77EF0
> > Content-Type: application/octet-stream;
> >     name="=?windows-1251?B?ze7i++kuc2NyLnV1ZQ==?="
> > Content-Transfer-Encoding: base64
> > Content-Disposition: attachment;
> >     filename="=?windows-1251?B?ze7i++kuc2NyLnV1ZQ==?="

> > И правило не сработало :(

> А если
> ${if match {${rfc2047d:$mime_filename}}
> ?

Или decode отдельным acl'ем (через warn) и match имени аттача по 
$mime_decoded_filename

-- 
George L. Yermulnik
[YZ-RIPE]

_______________________________________________
Exim-users mailing list
Exim-users@mailground.net
http://mailground.net/mailman/listinfo/exim-users

Ответить