Re: zmscanner question

[Eugene Crosser <crosser@rol.ru>]

On Wed, 2004-01-28 at 02:56, Ambrose Li wrote:

> at my work site, I have switch over to zmscanner today;
> previously, I have been using a Perl script I wrote, but
> my script is too demanding for the server and was thus
> causing mail problems.

Oh, the first user, at last! :-)

> I wonder if anyone already using zmscanner would know
> offhand some configuration questions :
> 
> - ct_check checks the "file" attribute in Content-Type but
>   not the "filename" attribute in Content-Disposition. Is
>   this a problem in real-world-encountered virus-infected
>   emails?

This I do not know.  I implemented check_ct as a quick hack to block
executable attachments.  Works for me.

> - If I load zms_dehtml, is it possible for zms_pcre to see
>   the raw HTML?

zms_pcre only binds to content_text_plain, that is, text/plain body
parts and result of zms_dehtml.  If you look at the last line of
zms_hehtml.c file, and change first argument of ZMS_MODULE from
"content_text_plain" to "content_text", it will process all parts of the
type "text/<anything>", but *not* the output of zms_dehtml.

You can tell the module to process more than one type (bind to more than
one "stage") by changing ZMS_MODULE() call in the last line to this
construct:

ZMS_MODINIT_FUNC
{
	ZMS_CLAIM_STAGE("content_text_plain","pcre",pcre_setup,pcre_term,pcre_scan);
	ZMS_CLAIM_STAGE("content_text_html","pcre",pcre_setup,pcre_term,pcre_scan);
}

> - Is it possible to denote in pcre.conf that a regexp is
>   only valid for a certain part of the mail (e.g., in the
>   envelope, a header, a body, etc.)?

any module only processes the chunks that are passed to the "stage" that
this module "claims" by other modules.  As shipped, pcre module
processes text/plain body parts only (as identified by the MIME parser
module), zms_dehtml being a "proxy" that calls "content_text_plain"
stage on the result of dehtmlizing "content_text_html" parts.

Eugene


-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to majordomo@nic.funet.fi