Encrypted rar

[Grooz, Marc (regio iT)]

Hi,

I have a case where a encrypted rar archiv isn’t blocked by amavis becouse the filelist is also crypted.

For example:

(!)Decoding of p003 (RAR archive data, v6f,) failed, leaving it unpacked: do_unrar: can't get a list of archive members: exit 11; 0 files
p.path test at example.org: "P=p004,L=1,M=multipart/mixed | P=p003,L=1/2,M=application/x-rar-compressed,T=rar,N=twain_32_verschluesselt.rar", matching_key="(?^:^\\.(zip|rar|arc|arj|zoo|7z)$)"
p003 1/2 Content-Type: application/x-rar-compressed, base64, size: 30206, SHA1 digest: 7a818f8ab8d5b1a97a3594367585b7f983b6db68, name: twain_32_verschluesselt.rar

Blocking rar archives where the filelist isn’t encrypted is no problem.

How could amavis block such archives without blocking all rar types?

Regards Marc

i. A. Marc Grooz
Teamleiter Internet & Web/Stellv. Leiter Operation-Center
---------------------------------------------------------------------------------
regio iT
gesellschaft für informationstechnologie mbh
Lombardenstraße 24, 52070 Aachen
tel  +49 241 41359-9638
fax +49 241 413540-9638
Marc.Grooz at regioit.de<mailto:Marc.Grooz at regioit.de>
www.regioit.de<http://www.regioit.de>

Aufsichtsratsvorsitzender: Axel Hartmann
Geschäftsführung: Dieter Rehfeld (Vors.), Dieter Ludwigs
Sitz der Gesellschaft: Aachen
Niederlassung: Gütersloh
Handelsregister-Nummer: HRB 552, Amtsgericht Aachen

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.amavis.org/pipermail/amavis-users/attachments/20181108/42834cff/attachment.html>