<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Vain tekstinä Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Seliteteksti Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.VaintekstinChar
{mso-style-name:"Vain tekstinä Char";
mso-style-priority:99;
mso-style-link:"Vain tekstinä";
font-family:"Calibri","sans-serif";}
p.PlainText, li.PlainText, div.PlainText
{mso-style-name:"Plain Text";
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:Consolas;}
span.Shkpostityyli21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.Shkpostityyli22
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.Shkpostityyli23
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.Shkpostityyli24
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.SelitetekstiChar
{mso-style-name:"Seliteteksti Char";
mso-style-priority:99;
mso-style-link:Seliteteksti;
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=FI link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>We also have ClamAV blocking all files containing OLE2 Macros, so I am going for a belt-and-suspenders type of approach…<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Regardless of the effectivity of blocking certain types of files or not, my main point for posting was the inability of amavis to clearly report which file was blocked when the blocked file is being detected as a container (e.g. a zip-file) containing other files.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='color:#595959'>--<o:p></o:p></span></p><p class=MsoNormal><span style='color:#595959'>Kai.Risku@arrak.fi GSM +358-40-7678282<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#595959'>Oy Arrak Software Ab http://www.arrak.fi<o:p></o:p></span></p></div><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> amavis-users [mailto:amavis-users-bounces+kai.risku=arrak.fi@amavis.org] <b>On Behalf Of </b>Dino Edwards<br><b>Sent:</b> Tuesday, April 05, 2016 11:04 AM<br><b>To:</b> amavis-users@amavis.org<br><b>Subject:</b> RE: Banning .docm gives misleading error message<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>If you are trying to block office documents that will infect your PC with ransomware your approach will not work. The ransomware has been coming through with the old office document extensions. For example, the locky ransomware comes in with a .doc attachment. A more effective approach would be to block all old office extensions i.e. .xls, .doc etc. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US>From:</span></b><span lang=EN-US> amavis-users [<a href="mailto:amavis-users-bounces+dino.edwards=mydirectmail.net@amavis.org">mailto:amavis-users-bounces+dino.edwards=mydirectmail.net@amavis.org</a>] <b>On Behalf Of </b>Kai Risku<br><b>Sent:</b> Tuesday, April 5, 2016 2:54 AM<br><b>To:</b> <a href="mailto:amavis-users@amavis.org">amavis-users@amavis.org</a><br><b>Subject:</b> Banning .docm gives misleading error message<o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>In order to guard against malicious macros, we have banned all macro-enabled Office document formats, i.e. added the following to $banned_filename_re:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='text-indent:65.2pt'><span lang=EN-US># block macro-enabled office files<o:p></o:p></span></p><p class=MsoNormal style='text-indent:65.2pt'><span lang=EN-US>qr'.\.(xlsm|xltm|xlam|docm|dotm|pptm|potm|ppam|ppsm|sldm)$'i,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Since modern Office documents are technically zip-files, amavisd-new opens and processes the zip archive. For originating (outgoing) messages we bounce the banned emails so the poor sender can understand why his emails are not delivered, but in this case amavisd-new does not report the actual office document being banned but instead blames the first file inside the zip-archive. This results in very cryptic error messages, like:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US> Subject: BANNED contents from you (.txt,[Content_Types].xml)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText style='margin-left:65.2pt'><span lang=EN-US>Our content checker found<o:p></o:p></span></p><p class=MsoPlainText style='margin-left:65.2pt'><span lang=EN-US> banned name: .txt,[Content_Types].xml<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> in email presumable from you<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>It seems amavisd has a small “optimization” that skips banned checks for non-leaf nodes. I propose removing that so the actual office documents can be directly banned and correctly reported:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>--- amavisd 5 Apr 2016 06:30:18 -0000 1.24<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>+++ amavisd 5 Apr 2016 06:30:29 -0000<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>@@ -9912,7 +9912,9 @@<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'> my(@path) = @{$part->path};<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'> next if @path <= 1;<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'> shift(@path); # ignore place-holder root node<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>- next if @{$part->children}; # ignore non-leaf nodes<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>+ # also process non-leaf nodes or we cannot block office documents<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>+ # without alert about wrong parts (blames the innocent zip member)<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>+ # next if @{$part->children}; # ignore non-leaf nodes<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'> my(@descr_trad); # a part path: list of predecessors of a message part<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'> my(@descr); # same, but in form suitable for check on banned_namepath_re<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'> for my $p (@path) {<o:p></o:p></span></p><p class=MsoNormal style='margin-left:65.2pt'><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#595959'>--<o:p></o:p></span></p><p class=MsoNormal><span style='color:#595959'><a href="mailto:Kai.Risku@arrak.fi">Kai.Risku@arrak.fi</a> GSM +358-40-7678282<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#595959'>Oy Arrak Software Ab <a href="http://www.arrak.fi">http://www.arrak.fi</a><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p></div></body></html>