On Fri, Mar 05, 2004 at 01:11:02PM -0800,
Jeremy C. Reed <reed@???> is thought to have said:
> Can standard Exim do any filtering (like regular expressions) as SMTP DATA
> time?
>
> So a message can be rejected at end of DATA?
>
> I read in Exim 4.30 Specification chapter 14 that exim filters is applied
> at the start of each delivery attempt. So I assume that could be long
> after the SMTP QUIT.
>
> Could this be done with acl_smtp_data policy control using "condition" and
> "match"? If so, any examples available?
This is one I used when W32.Sobig.E was the worm du jour:
deny condition = ${if match{$header_date:}{\N\s--\d{4}$\N}{yes}{no}}
log_message = Malformed Date header (double dash on TZ). Probably \
W32.Sobig.E. Date: $header_date:
message = This message was refused because it looks \
like it is infected with the W32.Sobig.E worm. See\n\
http://www.sarc.com/avcenter/venc/data/w32.sobig.e@mm.html \
for details. If you feel this determination is in error, \
please forward the entire message to \
postmaster@??? and include code \"AV#1\" \
in the Subject
You should be able to get the idea from that. I'm sure you can find other
examples in the list archives.
--
--------------------------------------------------------------------
Tabor J. Wells twells@???
Fsck It! Just another victim of the ambient morality
