I have the following rule in my system filter:
# Exim filter
if error_message or not first_delivery
then
finish
endif
#
# followed by Nigels attachment blocking filter
#
#
if ($h_to contains "hotmail.com" and $h_from contains "uce.ac.uk") and
first_delivery
then
logwrite "$tod_log $message_id From=$sender_address To=$h_to
H=$sender_fullhost Hotmail destination frozen"
freeze "Hotmail destination frozen"
endif
This has the desired effect of freezing any mail destined for hotmail. I
then have a script run by cron every hour which forces delivery of the
frozen messages.
Last week, I upgraded our main MTA fron Solaris 2.5.1 to Solaris 2.6 and
took the opportunity to grab hold of exim 3.15. Being a fix release I
didn't expect there to be any difference in the way the filtering worked but
have just found out that under 3.15 the frozen messages get discarded rather
than delivered:
2000-07-19 09:00:02 13Eo17-0003xL-00 Unfrozen by forced delivery
2000-07-19 09:00:02 13Eo17-0003xL-00 => discarded (message_filter)
Without making any change to the system filter file I re-built 3.12 and
replaced 3.15 with it. Forced delivery of a frozen message now works again:
2000-07-19 11:00:07 13EqWe-0007DZ-00 Unfrozen by forced delivery
2000-07-19 11:00:09 13EqWe-0007DZ-00 => user@??? R=lookuphost
T=remote_smtp H=mc5.law5.hotmail.com [216.32.243.136] C="25
0 Requested mail action okay, completed"
2000-07-19 11:00:09 13EqWe-0007DZ-00 Completed
I put a test message in the queue then ran the 3.15 binary with -d10 to
produce the following:
/exim-3.15/build-SunOS5-5.6-sparc/exim -d10 -M 13Er0G-0007mC-00
Exim version 3.15 debug level 10 uid=0 gid=1
probably ndbm
Caller is an admin user
Caller is a trusted user
set_process_info: 29919 3.15 delivering specified messages
delivering message 13Er0G-0007mC-00
set_process_info: 29919 3.15 delivering 13Er0G-0007mC-00
Opened spool file 13Er0G-0007mC-00-H
user=root uid=0 gid=1 sender=root@???
sender_local=1 resent=no ident=root
Non-recipients:
Empty Tree
---- End of tree ----
recipients_count=1
body_linecount=1 message_linecount=13
LOG: 0 MAIN
Unfrozen by forced delivery
running system filter as uid=0 gid=1 euid=7000 egid=7000
Filter: start of processing
Sub-condition is false: error_message
Sub-condition is false: not first_delivery
Condition is false: error_message or not first_delivery
Condition is false: $h_subject is DEBUG_PW1
Match expanded arguments:
Subject = text/plain; charset=US-ASCII
Pattern =
(?:file)?name=("[^"]+\.(?:vb[se]|ws[fh]|jse?|exe|com|bat|shs)"|[\w.-]+\.(?:v
b[se]|ws[fh]|jse?|exe|com|bat|shs))
Condition is false: $header_content-type: matches
(?:file)?name=("[^"]+\\.(?:vb[se]|ws[fh]|jse?|exe|com|bat|shs)"|[\\w.-]+\\.(
?:vb[se]|ws[fh]|jse?|exe|com|bat|shs))
Match expanded arguments:
Subject = This is a test message
Pattern =
(?:Content-(?:Type:\s*[\w-]+/[\w-]+|Disposition:\s*attachment);\s*(?:file)?n
ame=|begin\s+[0-7]{3,4}\s+)("[^"]+\.(?:vb[se]|ws[fh]|jse?|exe|com|bat|shs)"|
[\w.-]+\.(?:vb[se]|ws[fh]|jse?|exe|com|bat|shs))[\s;]
Condition is false: $message_body matches
(?:Content-(?:Type:\\s*[\\w-]+/[\\w-]+|Disposition:\\s*attachment);\\s*(?:fi
le)?name=|begin\\s+[0-7]{3,4}\\s+)("[^"]+\\.(?:vb[se]|ws[fh]|jse?|exe|com|ba
t|shs)"|[\\w.-]+\\.(?:vb[se]|ws[fh]|jse?|exe|com|bat|shs))[\\s;]
Sub-condition is false: $h_subject contains ILOVEYOU
Sub-condition is false: $h_subject contains I LOVE YOU
Sub-condition is false: $h_subject contains ILOVEYOU or $h_subject contains
I LOVE YOU
Sub-condition is false: $message_body contains LOVE-LETTER-FOR-YOU.TXT.vbs
Sub-condition is false: ($h_subject contains ILOVEYOU or $h_subject contains
I LOVE YOU) or $message_body contains LOVE-LETTER-FOR-YOU.TXT.vbs
Sub-condition is false: $message_body contains Barok
Sub-condition is false: (($h_subject contains ILOVEYOU or $h_subject
contains I LOVE YOU) or $message_body contains LOVE-LETTER-FOR-YOU.TXT.vbs)
or $message_body contains Barok
Sub-condition is false: $h_subject contains Susitikim shi
Condition is false: ((($h_subject contains ILOVEYOU or $h_subject contains I
LOVE YOU) or $message_body contains LOVE-LETTER-FOR-YOU.TXT.vbs) or
$message_body contains Barok) or $h_subject contains Susitikim shi
Sub-condition is false: $h_subject contains Resume
Condition is false: $h_subject contains Resume and $h_subject contains Janet
Simons
Sub-condition is false: $message_body contains RegWrite
Condition is false: $message_body contains RegWrite and $message_body
contains WIN-BUGSFIX
Sub-condition is false: $h_subject contains Mothers
Condition is false: $h_subject contains Mothers and $message_body contains
mothersday.vbs
Sub-condition is false: $h_subject contains Barok
Sub-condition is false: $h_subject contains email.passwords.sender.trojan
Sub-condition is false: $h_subject contains Barok or $h_subject contains
email.passwords.sender.trojan
Sub-condition is false: $h_to contains mailme@???
Condition is false: ($h_subject contains Barok or $h_subject contains
email.passwords.sender.trojan) or $h_to contains mailme@???
Condition is false: $h_subject contains Important Message From
Condition is false: $message_headers contains bobsamson00@???
Condition is false: $message_body contains BubbleBoy
Sub-condition is true: $h_to contains hotmail.com
Sub-condition is true: $h_from contains uce.ac.uk
Sub-condition is true: $h_to contains hotmail.com and $h_from contains
uce.ac.uk
Sub-condition is true: first_delivery
Condition is true: $h_to contains hotmail.com and $h_from contains uce.ac.uk
and first_delivery
writing filter log as euid 7000
Filter: freeze "Hotmail destination frozen"
Filter: at end "delivered" is true
Filter: end of processing
LOG: 1 MAIN
=> discarded (message_filter)
Delivery address list:
search_tidyup called
set_process_info: 29919 3.15 tidying up after delivering 13Er0G-0007mC-00
Processing retry items
Succeeded addresses:
Failed addresses:
Deferred addresses:
end of retry processing
LOG: 0 MAIN
Completed
end delivery of 13Er0G-0007mC-00
Has something changed in the way Exim processes filter files?
Paul Walsh
Senior Systems Programmer, Information Services,
University of Central England, BIRMINGHAM B42 2SU, UK
Tel: +44 (0)121 331 5708 Fax: +44 (0)121 356 2875
