Re: Exiscan & detecting MIME attachments

Carl Inglis wrote:
> I posted this to the Exim-Users mailing list and Tom (and David) were
>  kind enough to suggest I use exiscan.
> 
> 
>> I've been asked by management (always a worrying way to start an
>> email) to setup a method of detecting attachments entering and
>> leaving the company via email. I've written a perl script to accept
>> a message on STDIN, break it down into its parts if it's MIME,
>> detect if any of its parts are non text/*, send an email to a
>> nominated address and return the message unedited on its STDOUT.
> 
> 
> I've looked at the documentation and as far as I can see the acl
> would be called once per MIME part. If my understanding is correct,
> is there a "no_more" flag that I can set to say to the acl to only be
> called once per message? Otherwise I'm going to get one email (see
> above) per MIME part, and some of these emails have 10's of embedded
> images [sigh].

Carl,

What exactly do you need to achieve? If you stop processing after the first attachment in a message then you'll not be doing a good job of logging attachments.

The following will build a list of filename md5sum and file size for each attachment and store it in acl_m2. 


acl_check_mime:
warn  condition  = ${if !eq{$mime_filename}{}{1}{0}}
      decode     = default

# Obtain MD5sum for file attachments.
warn  condition  = ${if !eq{$mime_filename}{}{1}{0}}
      condition  = ${if !match{$mime_content_type}{\N^message\/rfc822$\N}{1}{0}}
      set acl_m1 = ${run{/usr/bin/md5sum $mime_decoded_filename}{${extract{1}{ }{$value}}}{}}

# Append Filename, MD5sum and Size details to a list
warn  condition  = ${if !eq{$acl_m1}{}{1}{0}}
      set acl_m2 = ${if  eq{$acl_m2}{} \
          {${quote:$mime_filename}=MD5:$acl_m1;SIZE:${mime_content_size}KB} \
          {$acl_m2 ${quote:$mime_filename}=MD5:$acl_m1;SIZE:${mime_content_size}KB}}

accept


Then you can display this in the eximlog with just the following in the data acl:

# Log File Attachment Details
warn  log_message = ATTACHMENTS: $acl_m2
      condition   = ${if !eq{$acl_m2}{}{1}{0}}


If there's more you need to do with the files, then you can do so with "run" directives during the MIME acl. E.g. copying the attachment into a timestamp based directory or something.

Cheers,
Matt.