[Exim] Exim4.20: drop in acl_check_data

Top Page
Delete this message
Reply to this message
Author: exim-users-admin
Date:  
To: exim-users
Subject: [Exim] Exim4.20: drop in acl_check_data
Hello!

Docs say:

drop: This verb behaves like deny, except that an SMTP connection is
forcibly closed after the 5xx error message has been sent.

I have the following acl:

acl_check_data:
   deny message = This message contains a virus Win32.HLLM.Gibe.2
         condition = ${if match {$message_body}{.*this is the latest
security update.*}{yes}{no}}
         log_message = This message contains a virus Win32.HLLM.Gibe.2



And that's what I have in this case when running exim -d+expand -bs:
......
check condition = ${if match {$message_body}{.*this is the latest
version of security.*}{yes}{no}}
expanding: $message_body
    result: This is a multi-part message in MIME format.
------=_NextPart_000_0014_01C3949C.2E22D6B0 Content-Type: text/plain;
charset="iso-8859-1" Content-Transfer-Encoding: 7bit   ----- Original
Message ----- From: "Mail Delivery Subsystem"
<MAILER-DAEMON@???> To: <carlo.viola@???>
Sent: Friday, October 17, 2003 9:13 AM Subject: Returned mail: see
transcript for details   > The original message was received at Wed, 15
Oct 2003 10:49:06 +0200 > from h-213-217-187-22.albacom.net
[213.217.187.22] (may be forged) > >    ----- The following addresses
had permanent fatal errors ----- > <zaretsky@???> >     (reason:
550 "This message contains a virus Win32.HLLM.Gibe.2) >
<trooper@???> >     (reason: 550 "This message contains a virus
Win32.HLLM.Gibe.2) > >    ----- Transcript of session follows ----- >
... while talking to xxxx.: > >>> DATA > <<< 550 "This message contains
a virus Win32.HLL
**** debug string too long - truncated ****
expanding: .*this is the latest version of security update, the.*
    result: .*this is the latest version of security update, the.*
condition: match {$message_body}{.*this is the latest version of
security update, the.*}
    result: true
expanding: yes
    result: yes
expanding: no
    result: no
skipping: result is not used
expanding: ${if match {$message_body}{.*this is the latest version of
security update, the.*}{yes}{no}}
    result: yes
                 = yes
drop: condition test succeeded

SMTP>> 550 This message looks like Win32.HLLM.Gibe.2 virus

LOG: MAIN REJECT
U=root F=<> rejected after DATA: This message looks like
Win32.HLLM.Gibe.2 virus
LOG: smtp_connection MAIN
SMTP connection from root closed by DROP in ACL
search_tidyup called
>>>>>>>>>>>>>>>> Exim pid=30631 terminating with rc=1 >>>>>>>>>>>>>>>>

550 This message looks like Win32.HLLM.Gibe.2 virus


looks like all should work.

then I telnet to this host and try to send the same message as I have
done before:
telnet xxxx 25
220 xxxx ESMTP Fri, 17 Oct 2003 14:39:11 +0300
mail from:<>
250 OK
rcpt to:<trooper@???>
250 Accepted
data
.......

------=_NextPart_000_0014_01C3949C.2E22D6B0--

.
Connection closed by foreign host.


And I doesn't have got any 550 error message.

Is it a bug of exim or I do something wrong?

--
Best wishes,
Dmitry Sergienko
Trifle Co., Ltd.