[Mimedefang] Filter Timed out.

[Helpdesk - iWavesystems.com]

On Monday, February 10, 2003 4:48 PM
Tony Nugent <tony at linuxworks.com.au> wrote:

> On Mon Feb 10 2003 at 16:25, "Helpdesk - iWavesystems.com" wrote:
>
>> Hi,

> Perhaps the error is triggered by a specific condition or subroutine
> in your filter caused by something specific in some messages?
> Without looking at your filter it is hard to know.  (Please don't
> post it to the list without trimming it considerably to remove
> non-essential comments and so on).

This is my mimedefang-filter

$AdminAddress = 'defang-admin at mail.iwavesystems.com';
$AdminName = "Mail Administrator's";
$Administrator = 'helpdesk at iwavesystems.com';
$MailAdmin = 'helpdesk at mail.iwavesystems.com';
$DaemonAddress = 'mimedefang at mail.iwavesystems.com';

$Stupidity{"flatten"} = 1;

$Stupidity{"NoMultipleInlines"} = 1;

sub filter_bad_filename {
    my($entity) = @_;
    return re_match($entity,
'\.(bat|chm|cmd|com|cpl|dll|exe|hlp|hta|ini|js|lib|lnk|msi|msp|ocx|pif|reg|s
cr|sct|shb|shs|sys|vbe|vbs?|vxd|wsf|wsh)');
}

sub filter_begin {
    $Boilerplate = "";

# ALWAYS drop messages with suspicious chars in headers or body
if ($SuspiciousCharsInHeaders || $SuspiciousCharsInBody) {
        action_quarantine_entire_message();
if ($SuspiciousCharsInHeaders) {
            action_notify_administrator("Message quarantined because of
suspicious characters in headers");
        } else {
            action_notify_administrator("Message quarantined because of
suspicious characters in body");
        }
# Do NOT allow message to reach recipient(s)
        return action_discard();
    }

# Spam checks if SpamAssassin is installed
    if ($Features{"SpamAssassin"}) {
        if (-s "./INPUTMSG" < 256*1024) {
# Only scan messages smaller than 256kB.  Larger messages
# are extremely unlikely to be spam, and SpamAssassin is
# dreadfully slow on very large messages.
my($hits, $req, $names, $report) = spam_assassin_check();
if ($hits >= $req) {
                my($score);
                if ($hits < 40) {
                    $score = "*" x int($hits);
                } else {
                    $score = "*" x 40;
                }
# minimum number of asterisks...
                action_change_header("X-Spam-Score", "$hits ($score)
$names");
                $Boilerplate = $report;
            }
        }
    }
}

sub filter {
        my($entity, $fname, $ext, $type) = @_;
        my($code, $category, $action) = entity_contains_virus_nai ($entity);
        action_add_header('X-Virus-Scanned', $fname ? "$fname: $action" :
            "Message: $action");

        $VirusScannerMessages =~ s/^\/var.*\n//g;
        $VirusScannerMessages =~ s/^\s+//;

        if ($action eq 'quarantine') {
            my $msg =
                "                    V I R U S   A L E R T\n\n" .
                "Our virus scanner found a VIRUS in your email to " .
                "BLAH BLAH BLAH" .
                "VIRUS\nDEFINITIONS.\n\nOur virus scanner found the " .
                "following virus:\n\n$VirusScannerMessages\n";
            if (open (IN, 'HEADERS')) {
                $msg .= "\n-----Original Message Headers-----\n";
                while () { $msg .= $_ }
                close(IN);
            }

            if ($Sender ne '<>') {
                action_notify_sender($msg);
            }
            action_notify_administrator("-----Original Message-----\n" .
                "From: $DaemonName <$DaemonAddress>\n" .
                "Sent: " . localtime() . "\n" .
                "To: $Sender\n" .
                "Subject: MIMEDefang Notification.\n\n" .
                $msg);
            add_recipient($Administrator);
            return action_quarantine($entity, "                    V I R U
S" .
                "   A L E R T\n\nOur virus scanner found a VIRUS in this " .
                "email from $Sender.\nAn attachment named \'$fname\' was " .
                "removed from this email because it\ncontained a virus.  " .
                "The virus scanner reported the following:\n\n" .
                "$VirusScannerMessages\n");
        } elsif (filter_bad_filename($entity)) {
            add_recipient($Administrator);
            return action_quarantine($entity, "An attachment named " .
            "\'$fname\' was removed from this email because it\nconstituted
" .
            "a security hazard.  If you require this document, please\n" .
            "contact the sender and arrange an alternate means of receiving
" .
            "it.\n");
        }
        return action_accept();
        add_recipient($MailAdmin);
    }
sub filter_multipart {
    my($entity, $fname, $ext, $type) = @_;

    if (filter_bad_filename($entity)) {
        action_notify_administrator("A MULTIPART attachment of type $type,
named $fname was dropped.\n");
        return action_drop_with_warning("An attachment of type $type, named
$fname was removed from this document as it\nconstituted a security hazard.
If you require this document, please contact\nthe sender and arrange an
alternate means of receiving it.\n");
    }

    # eml is bad if it's not message/rfc822
    if (re_match($entity, '\.eml') and ($type ne "message/rfc822")) {
        return action_drop_with_warning("A non-message/rfc822 attachment
named $fname was removed from this document as it\nconstituted a security
hazard.  If you require this document, please contact\nthe sender and
arrange an alternate means of receiving it.\n");
    }

    return action_accept();
}


sub defang_warning {
    my($oldfname, $fname) = @_;
    return
        "An attachment named '$oldfname' was converted to '$fname'.\n" .
        "To recover the file, right-click on the attachment and Save As\n" .
        "'$oldfname'\n";
}

# If SpamAssassin found SPAM, append report.  We do it as a separate
# attachment of type text/plain
sub filter_end {
    my($entity) = @_;
    }
#No sense doing any extra work
    return if message_rejected();

#    if ($Boilerplate ne "") {
#       action_add_part($entity, "text/plain", "-suggest", "$Boilerplate\n",
#                       "SpamAssassinReport.txt", "inline");
#    }

# DO NOT delete the next line, or Perl will complain.
1;

perl -w /etc/mail/mimedefang-filter gives this

Name "main::AdminAddress" used only once: possible typo at
/etc/mail/mimedefang-filter.
Name "main::Features" used only once: possible typo at
/etc/mail/mimedefang-filter.
Name "main::DaemonName" used only once: possible typo at
/etc/mail/mimedefang-filter.
Name "main::AdminName" used only once: possible typo at
/etc/mail/mimedefang-filter.
Name "main::SuspiciousCharsInBody" used only once: possible typo at
/etc/mail/mimedefang-filter.
Undefined subroutine &main::message_rejected called at
/etc/mail/mimedefang-filter.

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Manjunath H N
Consultant
iWave Systems Technologies Pvt Ltd.,
#7/B, 29th Main, BTM 2nd Stage
Bangalore - 560 076
Phone NO: 6786243 / 6786245 EXTN: 220
helpdesk at iwavesystems.com
http://www.iwavesystems.com
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~


DISCLAIMER:

This e-mail and any attachment (s) is for authorised use by the intended recipient (s) only. It may contain proprietary material, confidential information and/or be subject to the legal privilege of iWave Systems Technologies Private Limited. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from retaining, using, copying, alerting or disclosing the content of this message. Thank you for your co-operation.