[exim] Mime + filename matching

Top Page
Delete this message
Reply to this message
Author: Craig Jackson
Date:  
To: exim-users
Subject: [exim] Mime + filename matching
Hi,

I have an acl to check for certain file names and quarantine those
emails with that attachment. Maybe I'm not understanding how Exim
handles MIME or I don't understand MIME, but here it goes. The acl looks
like this:

warn    condition = ${if or { { >{$message_size}{1536k}} { and { {

>{$message_size}{128k}}{ eq{${lookup

mysql{MYSQL_BIGSENDERS}}}{$sender_address}}} }}{1}{0}}
        condition = ${if or { \
                {
match{${lc:$mime_filename}}{\N^(?>.*)(?<=zip|emz|iso|wma|jpg|jpeg|pps|pp
t|gif|png|wmv|mpg|mp3|mpeg|avi|wav|bmp|mov|asf|asx|mpe)\N}} \
                {
match{${lc:$mime_content_type}}{\N^(zip|emz|iso|wma|jpg|jpeg|pps|ppt|gif
|png|wmv|mpg|mp3|mpeg|avi|wav|bmp|mov|asf|asx|mpe)\N}} \
                }{1}{0}}
        set acl_m7 = 1


This acl works perfectly except for certain emails and I'm not smart
enough to figure out how to get Exim to work to work with those emails.
Here's a sample header and MIME boundary:

Header:
Content-Type: multipart/alternative;
boundary="____LFVVWSBYYJXOSAVCXGEW____"

MIME boundary:
--____LFVVWSBYYJXOSAVCXGEW____
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

=20

--____LFVVWSBYYJXOSAVCXGEW____
Content-Type: multipart/related; boundary="____RAAJBJVHFFDKGUUJDDWU____"


--____RAAJBJVHFFDKGUUJDDWU____
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html;
charset=3Diso-8859-=
1">
<META content=3D"MSHTML 6.00.2900.3243" name=3DGENERATOR></HEAD>
<BODY style=3D"MARGIN: 4px 4px 1px; FONT: 14pt Technical"><IMG
src=3D"cid=
:LTPCYOQCHLLK.GW}00014.BMP"></BODY></HTML>

--____RAAJBJVHFFDKGUUJDDWU____
Content-ID: <LTPCYOQCHLLK.GW}00014.BMP>
Content-Type: image/BMP
Content-Transfer-Encoding: base64

Seems to me that the acl should have seen that MIME boundary and set
acl_m7 to 1. Can someone please tell me why it didn't?

Thanks.
Craig