On Mon, Jun 2, 2014 at 11:43 AM, Noel Jones <[email protected]> wrote: > On 6/1/2014 1:52 PM, Jeffrey 'jf' Lim wrote: >> On Sun, Jun 1, 2014 at 1:11 PM, Inteq Solution - Dep. Tehnic >> <[email protected]> wrote: >>> Hello >>> >>> >>> >>> Tonight, while checking Postfix config, I have stumbled upon something >>> weird. >>> >>> >>> >>> I am blocking executables and potentially dangerous extensions with >>> header_checks = pcre:/etc/postfix/header_checks.pcre >>> >>> Inside header_checks.pcre I have: >>> >>> /^Content-(Disposition|Type).*name\s*=\s*"?(.*(\.|=2E)(ade|adp|asp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|hlp|ht[at]|inf|ins|isp|jse?|lnk|md[betw]|ms[cipt]|nws|\{[[:xdigit:]]{8}(?:-[[:xdigit:]]{4}){3}-[[:xdigit:]]{12}\}|ops|pcd|pif|prf|reg|sc[frt]|sh[bsm]|swf|vb[esx]?|vxd|ws[cfh]))(\?=)?"?\s*(;|$)/x >>> REJECT Attachment name "$2" not allowed >>> >>> >>> >>> >>> >>> Sending an email with a *.bat extension gives the expected result. The email >>> is blocked with the message: >>> >>> '[email protected]' on 01.06.2014 07:41 >>> >>> 550 5.7.1 Attachment name "test.bat" not allowed >>> >>> >>> >>> I also have a mime_header_checks = regexp:/etc/postfix/mime_header_checks >>> with the content: >>> >>> /name=[^>]*\.(ade|adp|asp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|hlp|ht|inf|ins|isp|jse?|lnk|md|ms|nws|ops|pcd|pif|prf|reg|sc|sh|swf|vb|vxd|ws|pl|py)/ >>> REJECT Attachment not allowed >>> >>> >>> >>> Nevertheless, using http://www.emailsecuritycheck.net/ and sending a test >>> email to my address, a file with .bat extension slips through without being >>> blocked. >>> >>> >>> >>> I must be doing something wrong, but no matter how I look at it, I do not >>> see it. >>> >>> >>> >>> Any hints please? >>> >>> >> >> I'm not really familiar with the usage of pcre with postfix, but >> something you might want to check: are your regexes case-sensitive? >> >> http://www.postfix.org/pcre_table.5.html has some weird description >> which I dont get, and which perhaps somebody could explain to me: >> ============== >> By default, matching is case-insensitive, and newlines are not treated >> as special characters. The behavior is controlled by flags, which are >> toggled by appending one or more of the following characters after the >> pattern: > > The above text seems quite clear. By default, postfix pcre matching > is case-insensitive, which is the vast majority of use cases. > >> >> i (default: on) >> Toggles the case sensitivity flag. By default, matching is case >> insensitive. >> ==================== > > the /i flag toggles the case-insensitive behavior; ie. including the > flag makes matching case sensitive. This also seems quite clear. >
Thanks. I read that as meaning that the /i flag is automatically on, even if you don't specify it, with "/i" meaning "case-insensitive". Thanks for clearing that up. > > and this has nothing to do with the OP's problem. > it does, because I was thinking that the regexes might not have matched, because the file was sent as a ".BAT", as opposed to a ".bat". Anyway, to clear things up, so then the regex is case-insensitive, and this was not the problem. -jf
