Mailing List Archive: exim: users

content type matching acl

Index | Next | Previous | View Threaded

CJackson at abbott-simses

Aug 14, 2008, 1:51 PM

Post #1 of 5 (621 views)
Permalink

content type matching acl

Hi,

In the mime acl, there is a condition for catching emails with certain
content types:

match{${lc:$mime_content_type}}{\N^(?>.*)(?<=m4a|powerpoint|ppt|pps|quic
ktime|msvideo|javascript|midi|zip|wma|jpg|jpeg|gif|png|wmv|mpg|mp3|mpeg|
mpeg-2|avi|wav|bmp|mov|asf|asx|mpe)\N}

However, an email with a gif got through that had a content type as
follows:

Content-Type: image/gif;
name="image001.gif"

Is the final quote the problem? Or is the filename located in the
content type the problem? Could this be fixed by adding "? to the regex
like this?

match{${lc:$mime_content_type}}{\N^(?>.*)(?<=m4a|powerpoint|ppt|pps|quic
ktime|msvideo|javascript|midi|zip|wma|jpg|jpeg|gif"?|png|wmv|mpg|mp3|mpe
g|mpeg-2|avi|wav|bmp|mov|asf|asx|mpe)\N}

Thanks,
Craig

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

exim-users at spodhuis

Aug 14, 2008, 2:35 PM

Post #2 of 5 (586 views)
Permalink

Re: content type matching acl [In reply to]

On 2008-08-14 at 15:51 -0500, Craig Jackson wrote:
> In the mime acl, there is a condition for catching emails with certain
> content types:
>
>
> match{${lc:$mime_content_type}}{\N^(?>.*)(?<=m4a|powerpoint|ppt|pps|quic
> ktime|msvideo|javascript|midi|zip|wma|jpg|jpeg|gif|png|wmv|mpg|mp3|mpeg|
> mpeg-2|avi|wav|bmp|mov|asf|asx|mpe)\N}
>
> However, an email with a gif got through that had a content type as
> follows:
>
> Content-Type: image/gif;
> name="image001.gif"
>
> Is the final quote the problem? Or is the filename located in the
> content type the problem? Could this be fixed by adding "? to the regex
> like this?

No; $mime_content_type does not include any options such as "name" so
that's not being considered. (In theory; I haven't checked source).

If you take a copy of the received message, strip off headers added by
your system, run "exim -d+acl+expand -bs -bh orig.in.al.ip" then do SMTP
to send the message, you'll (a) not deliver it, so don't worry about
duplicates and (b) be able to see the ACL logic and the string
expansions. The string expansion should show you what was in
$mime_content_type and the ACL debugging logic as a whole will confirm
that this condition was even being tested.

-Phil

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

CJackson at abbott-simses

Aug 25, 2008, 8:48 AM

Post #3 of 5 (502 views)
Permalink

Re: content type matching acl [In reply to]

> -----Original Message-----
> From: exim-users-bounces[at]exim.org
> [mailto:exim-users-bounces[at]exim.org] On Behalf Of Phil Pennock
> Sent: Thursday, August 14, 2008 4:36 PM
> To: Craig Jackson
> Cc: exim-users[at]exim.org
> Subject: Re: [exim] content type matching acl
>
> On 2008-08-14 at 15:51 -0500, Craig Jackson wrote:
> > In the mime acl, there is a condition for catching emails
> with certain
> > content types:
> >
> >
> >
> match{${lc:$mime_content_type}}{\N^(?>.*)(?<=m4a|powerpoint|pp
t|pps|quic
> >
> ktime|msvideo|javascript|midi|zip|wma|jpg|jpeg|gif|png|wmv|mpg
> |mp3|mpeg|
> > mpeg-2|avi|wav|bmp|mov|asf|asx|mpe)\N}
> >
> > However, an email with a gif got through that had a content type as
> > follows:
> >
> > Content-Type: image/gif;
> > name="image001.gif"
> >
> > Is the final quote the problem? Or is the filename located in the
> > content type the problem? Could this be fixed by adding "?
> to the regex
> > like this?
>
> No; $mime_content_type does not include any options such as "name" so
> that's not being considered. (In theory; I haven't checked source).
>
> If you take a copy of the received message, strip off headers added by
> your system, run "exim -d+acl+expand -bs -bh orig.in.al.ip"
> then do SMTP
> to send the message, you'll (a) not deliver it, so don't worry about
> duplicates and (b) be able to see the ACL logic and the string
> expansions. The string expansion should show you what was in
> $mime_content_type and the ACL debugging logic as a whole will confirm
> that this condition was even being tested.
>
> -Phil
>

I am having this problem with several emails that are getting through
this acl. I ran the test you suggested. The result was ">>
No Content-Type: header - presumably not a MIME message." But the
Content-Type header is clearly there:

Content-Class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----_=_NextPart_001_01C90494.E72C586C"
Subject: FW: Funny Felines
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4325
Date: Fri, 22 Aug 2008 15:23:13 -0500
Content-Transfer-Encoding: 7bit
Message-ID: <02355FF52957E4469532537DB5D75FA1051071[at]DCR-MAIL.domain.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:

And the mime boundary is also there:

------_=_NextPart_002_01C90494.E72C586C--

------_=_NextPart_001_01C90494.E72C586C
Content-Type: image/jpeg;
name="ATT13960.jpg"
Content-Transfer-Encoding: base64
Content-ID: <_2_048B7F08048B84A8006E555C862574AD>
Content-Description: ATT13960.jpg
Content-Location: ATT13960.jpg

Why is Exim not seeing the mime part and what can I change to make it
see it?

Thanks for your reply.

Craig

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

exim-users at spodhuis

Aug 25, 2008, 11:00 AM

Post #4 of 5 (502 views)
Permalink

Re: content type matching acl [In reply to]

On 2008-08-25 at 10:48 -0500, Craig Jackson wrote:
> I am having this problem with several emails that are getting through
> this acl. I ran the test you suggested. The result was ">>
> No Content-Type: header - presumably not a MIME message." But the
> Content-Type header is clearly there:
>
> Content-Class: urn:content-classes:message
> MIME-Version: 1.0
> Content-Type: multipart/related;
> type="multipart/alternative";
> boundary="----_=_NextPart_001_01C90494.E72C586C"

The code (in Exim 4.69) iterates over all headers. It skips those
marked deleted (headers_remove) and check those left to match
"Content-Type:", case-insensitive.

Are you sometimes deleting headers, and possibly matching Content-Type?
Are these the top-level headers, not those from inside a multipart
message missing the MIME type at the top level?

If the answers are "no" and "yes", then please actually provide the
debug logs. If you ask for help (ie, can't figure it out yourself) and
are asked to provide debug logs, then *not* providing the logs because
you parsed out the content you think appropriate is really making life
harder for those trying to help you. Too much so.

-Phil

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

CJackson at abbott-simses

Aug 25, 2008, 2:04 PM

Post #5 of 5 (500 views)
Permalink

Re: content type matching acl [In reply to]

Ya back? We had cake & ice cream. Ugh.

> -----Original Message-----
> From: Phil Pennock [mailto:exim-users[at]spodhuis.org]
> Sent: Monday, August 25, 2008 1:00 PM
> To: Craig Jackson
> Cc: exim-users[at]exim.org
> Subject: Re: [exim] content type matching acl
>
> On 2008-08-25 at 10:48 -0500, Craig Jackson wrote:
> > I am having this problem with several emails that are
> getting through
> > this acl. I ran the test you suggested. The result was ">>
> > No Content-Type: header - presumably not a MIME message." But the
> > Content-Type header is clearly there:
> >
> > Content-Class: urn:content-classes:message
> > MIME-Version: 1.0
> > Content-Type: multipart/related;
> > type="multipart/alternative";
> > boundary="----_=_NextPart_001_01C90494.E72C586C"
>
> The code (in Exim 4.69) iterates over all headers. It skips those
> marked deleted (headers_remove) and check those left to match
> "Content-Type:", case-insensitive.
>
> Are you sometimes deleting headers, and possibly matching
> Content-Type?
> Are these the top-level headers, not those from inside a multipart
> message missing the MIME type at the top level?
>
> If the answers are "no" and "yes", then please actually provide the
> debug logs. If you ask for help (ie, can't figure it out
> yourself) and
> are asked to provide debug logs, then *not* providing the logs because
> you parsed out the content you think appropriate is really making life
> harder for those trying to help you. Too much so.
>
> -Phil
> .
>

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com