who match first Filename Rules or Filetype Rules ?

[Sylvain Viart]

Hi,

I would like to know which rules will match first?

Where is it handled in the code?

Regards.
Sylvain.

[Sylvain Viart]

Post by Sylvain Viart
I would like to know which rules will match first?
Where is it handled in the code?

If I'm right it is handled by:

mailscanner/bin/MailScanner/SweepOther.pm
sub ScanBatch {

And /Filename Rules/ seems to be applied *before* /Filetype Rules/:

https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/SweepOther.pm#L154

The following at the end which seems to handle the Filetype Rules

https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/SweepOther.pm#L427

counter += CheckFileContentTypes($batch)

Someone confirms?

Regards.
Sylvain.

[Glenn Steen]

Sure, I'll bite... IIRC this is exactly true. Unlike with AV and spam
scanning, both tests will occur, so the individual order is not really
that relevant.... Unless you have a problem in one (or the other).

Cheers!
--
-- Glenn

Post by Sylvain Viart
I would like to know which rules will match first?
Where is it handled in the code?
mailscanner/bin/MailScanner/SweepOther.pm
sub ScanBatch {
https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/SweepOther.pm#L154
The following at the end which seems to handle the Filetype Rules
https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/SweepOther.pm#L427
counter += CheckFileContentTypes($batch)
Someone confirms?
Regards.
Sylvain.
--
MailScanner mailing list
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se

[Sylvain Viart]

Hi,

Post by Glenn Steen
Sure, I'll bite... IIRC this is exactly true. Unlike with AV and spam
scanning, both tests will occur, so the individual order is not really
that relevant.... Unless you have a problem in one (or the other).
Cheers!

I found it in the doc!

So the answer is: The attachment must pass *all four tests before it is
allowed* to remain in the message.

The filename AND the filetype Rules.

From the PDF p.208

Allow Filenames =
This contains a space-separated list of regular expressions used as
rules which are applied to
the original fileames of attachments. If any of these rules matches,
then the filename is
accepted. This can also be the filename of a ruleset.

Deny Filenames =
This contains a space-separated list of regular expressions used as
rules which are applied to
the original filenames of attachments. If any of these rules
matches, then the filename is not
accepted, and the attachment is blocked. This can also be the
filename of a ruleset.

Allow Filetypes =
This contains a space-separated list of regular expressions. These
expressions are matched
against the output of the “file” command. If any of the expressions
match, then the
attachment is accepted and allowed to remain in the message. This
can also be the filename of
a ruleset.

page 197

Deny Filetypes =
This contains a space-separated list of regular expressions, and is
used similarly to the “Allow
Filetypes” option above. If and of the expressions match, then the
attachment is blocked and
removed from the message. This can also be the filename of a ruleset.

The attachment must pass *all four tests before it is allowed* to
remain in the message. If none of the
regular expressions match at all, then the previous system based
around “filename.rules.conf” and
“filetype.rules.conf” is applied to the attachment instead, and all
of those tests must pass for it to
remain in the message.


So I can't allow filename to skip filetype, for a specific filename.
Filetype will still deny it.

The code doesn't reveal that, for me for now.

Still digging.

Regards.