RE: demime question..

> what I would like to end up with is with the first example as what I 
> have to work with.
> 
> And I cannot figure out why I am unable to end up with what I want.
> 
> - Brian

Brian,

Here's a couple of sections from my ACLs, it should include what your
looking for. There's extension blocking as well as CLSID blocking, and
arbitrary MD5 sum logging and blocking, which you may also find useful.

Cheers,
Matt.



acl_check_mime:
  # Decode MIME parts to disk. This will support virus scanners later.
  warn          decode          = default

  # File extension filtering.
  deny          set acl_m1      =
${extract{-1}{.}{${lc:$mime_filename}}}
                message         = This message contains a prohibited
file extension ($acl_m1)
                log_message     = REJECTED ATTACHMENT ($acl_m1)
                condition       = ${if
match{$acl_m1}{\N^(vbs|vbe|wsf|wsh|js|jse|exe|com|cmd|shs|hta|bat|scr|ln
k|pif)$\N}{1}{0}}

  # CLSID Attachment Blocking
  deny          condition       = ${if
match{$mime_filename}{\N\{[a-hA-H0-9-]{25,}\}\N}{1}{0}}
                message         = REJECTED ATTACHMENT (CLSID)

  # Refuse Empty (invalid) MIME Boundaries
  deny          condition       = $mime_is_multipart
                condition       = ${if eq{$mime_boundary}{}{yes}{no}}
                message         = MIME ERROR (Empty MIME Boundary)

  # Obtain MD5 Sum for file attachments.
  warn          condition       = ${if !eq{$mime_filename}{}{1}{0}}
                set acl_m1      = ${run{/usr/bin/md5sum
$mime_decoded_filename}{${extract{1}{ }{$value}}}{}}

  # Check MD5 Sum against Blacklist
  deny          condition       = ${if !eq{$acl_m1}{}{1}{0}}
                condition       =
${lookup{$acl_m1}lsearch{ETCDIR/reject_file_md5}{1}{0}}
                message         = This message contains a prohibited
file
                log_message     = BLACKLISTED ATTACHMENT $acl_m1
$mime_filename

  # Append File,MD5,Size details to a list.
  warn          condition       = ${if !eq{$acl_m1}{}{1}{0}}
                set acl_m2      = ${if  eq{$acl_m2}{} \
 
{$mime_filename=MD5:$acl_m1;SIZE:${mime_content_size}KB} \
                                        {$acl_m2
$mime_filename=MD5:$acl_m1;SIZE:${mime_content_size}KB}}

  accept


acl_check_data:
  # First unpack MIME containers and reject serious errors.
  deny          message         = This message contains a MIME error
($demime_reason)
                log_message     = MIME ERROR ($demime_reason)
                demime          = *
                condition       = ${if >{$demime_errorlevel}{2}{1}{0}}

  # Log File Attachment Details
  warn          log_message     = ATTACHMENTS $acl_m2
                condition       = ${if !eq{$acl_m2}{}{1}{0}}

  # Check for Viruses
  deny          message         = This message contains malware
($malware_name)
                malware         = *

  accept