expanding zipfiles remain unchecked

[Andreas Schulze]

Hello,

on an older amavis-instance (2.5.0) I found that
some mails are marked as unchecked because they contain zip files
expanding very much. Currently they pass the MTA.
Handling them like unscanable content would be better for me.

My workaround is setting MIN_ and MAX_EXPANSION_FACTOR to undef.
That let the mails pass if the are clean. But I risk a memory problem.

Are there better way to handle that situation so amavis
could reject them as unscanable like password protected zipfiles?

Thanks,
Andreas


# Mail passing uncheded
Apr  4 14:19:39 testserver amavis[8625]: (08625-01) p002 1/2 Content-Type: application/x-zip-compressed, size: 101911 B, name: 100mb_nullen.zip
Apr  4 14:19:39 testserver amavis[8625]: (08625-01) (!)Exceeded storage quota 65831000 bytes by do_unzip; last chunk 33764976 bytes
Apr  4 14:19:39 testserver amavis[8625]: (08625-01) NOTICE: Virus scanning skipped: Exceeded storage quota 65831000 bytes by do_unzip; last chunk 33764976 bytes
Apr  4 14:19:39 testserver amavis[8625]: (08625-01) (!)NOTICE: HOLD reason: Exceeded storage quota 65831000 bytes by do_unzip; last chunk 33764 976 bytes
Apr  4 14:19:39 testserver amavis[8625]: (08625-01) (!)Inserting header field: X-Amavis-Hold: Exceeded storage quota 65831000 bytes by do_unzip; last chunk 33764976 bytes ...
...
Apr  4 14:19:40 testserver amavis[8625]: (08625-01) Passed UNCHECKED, [192.168.2.1] [192.168.1.1] <user1 at example.org> -> <user2 at example.org>, Message-ID: <foobar1 at example.org>, mail_id: WVxMRjjZ3XBN, Hits: -, size: 131662, queued_as: 3AAC5200B7, 228 ms


# $MIN_EXPANSION_FACTOR = MAX_EXPANSION_FACTOR = undef
# Mail will be scanned an pass if clean
Apr  4 14:28:00 testserver amavis[9152]: (09152-01) p002 1/2 Content-Type: application/x-zip-compressed, size: 101911 B, name: 100mb_nullen.zip ...
...
Apr  4 14:28:01 testserver amavis[9152]: (09152-01) Passed CLEAN, [192.168.2.1] [192.168.1.1] < user1 at example.org > -> < user2 at example.org >, Message-ID: < foobar2 at example.org > , mail_id: Ow2Cr+LpBiQ4, Hits: -, size: 131663, queued_as: 43073200BE, 392 ms

 
-- 
Andreas Schulze
Internetdienste | P252

DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Dipl.-Kfm. Dr. Robert Mayr
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen