[Mimedefang] re_match in filter_begin

Kevin A. McGrail kmcgrail at pccc.com
Fri Feb 29 16:14:32 EST 2008

>>>   if (re_match($entity, '\.(doc|docx).*$')) {
>>> However, this doesn't seem to work.

> That is correct.  It has to be done in filter(), not filter_begin().
> The $entity passed to filter_begin is the top-level MIME container
> and it won't have anything re_match can usefully process.

Ok, then since others tested and ClamAV detects it, here's my current 
band-aid from filter_begin.  I wanted to add an extra check with ClamAV for 
files that are word documents in sub filter.  Perhaps no one else cares but 
it might be helpful to others!


      # Enabling ClamAV ONLY to scan doc files
      if (re_match($entity, '\.doc')) {
        md_syslog('warning', "$QueueID: Enabling ClamAV");
        $Features{'Virus:NAI_temp'} = $Features{'Virus:NAI'};
        $Features{'Virus:NAI'} = '';
        $Features{'Virus:CLAMAV'} = '/usr/local/clamav/bin/clamscan';
        $VirusScannerRoutinesInitialized = 0;

        # Scan for viruses if any virus-scanners are installed
        md_syslog('warning', "$QueueID: Checking for Virii.");
        my($code, $category, $action) = message_contains_virus();
        md_syslog('warning', "$QueueID: Virii check completed -- $code - 
$category - $action.");

        my ($FoundVirus);
        # Lower level of paranoia - only looks for actual viruses
        $FoundVirus = ($category eq "virus");

        # Higher level of paranoia - takes care of "suspicious" objects
        # $FoundVirus = ($action eq "quarantine");

        if ($FoundVirus) {
            md_graphdefang_log('virus', $VirusName, $RelayAddr);
            md_syslog('warning', "$QueueID: Discarding because of virus 
            &rr_log(report=>"virus - $VirusName");
            return action_discard();

        if ($action eq "tempfail") {
            action_tempfail("Problem running virus-scanner");
            md_syslog('warning', "$QueueID: Problem running virus scanner: 
code=$code, category=$category, action=$action");

        $Features{'Virus:NAI'} = $Features{'Virus:NAI_temp'};
        $Features{'Virus:CLAMAV'} = '';
        $VirusScannerRoutinesInitialized = 0;

More information about the MIMEDefang mailing list