Ray's Mail Filter Version 1.04/1.14
On this page:- Description Platform Copyright and Licence Requirements Rationale Theory Method Rejected Message Files SMTP reply Log files Known Bugs Interaction with Other Software Release Notes	Other pages:- Installation Configuration Operation Utilities

Description

The filter examines messages being processed by Sendmail, and accepts or rejects them on the basis of their header contents. In addition to the main message headers, the filter examines the MIME part headers within a multipart message. It can therefore be used to reject messages containing attachments with particular filenames or filename extensions.

Rejection criteria are controlled by configuration files, and can be changed without having to re-start the filter. Using the configuration files as supplied, the filter will reject any message that has an attachment of a type that is listed as "unsafe" in the Microsoft Outlook E-mail Security Update (Article ID: Q262617).

As a partial defence against malicious exploitation of the buffer overrun problem in certain versions of Microsoft Outlook, the filter will also reject messages whose Date header is more than 60 characters in length.

Rejected messages are saved in message files, annotated to show the reason for rejection. A log is kept of all messages processed by the filter.

Platform

H/W	O/S	Sendmail version	Remarks
Dec Alpha	Digital Unix V4.0F	8.10.1 8.11.0.Beta1 8.11.0	Development machine.
i686	Linux (Red Hat 6.1)	8.10.1
i686	Linux (Red Hat 6.2)	8.11.0

Copyright and Licence

The software is distributed under the terms of the GNU General Public Licence.

Requirements

• An ANSI-compatible C compiler is required to compile the program.

• The filter program has to be linked with the Sendmail Mail Filter API ("Milter"), which is distributed with Sendmail version 8.10.1 onwards.

• The Unix Syslog utility is used to keep a log of all messages processed.

• The shell scripts provided to start, stop and reset the filter require awk.

• The optional utility provided to analyze rejected messages requires perl.

Rationale

Theory

Content-Type: multipart/mixed;
        boundary="----_=_NextPart_000_01BFB5AF.795C3FBA"

------_=_NextPart_000_01BFB5AF.795C3FBA
Content-Type: application/octet-stream;
	name="LOVE-LETTER-FOR-YOU.TXT.vbs"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
	filename="LOVE-LETTER-FOR-YOU.TXT.vbs"

As the filter can scan all the message headers, it can also be configured to reject messages where, for example, the Subject header of the main message contains text which suggests the possible presence of a virus.

Method

Then, for each message received by Sendmail, the filter performs the following tasks:

• Reads each of the message headers. If the header name matches one of those in the configuration file, the header text (after the ':') is examined to see whether it contains any of the suspect text strings. The message is flagged for rejection if a match is found. If a Date header is found, it is checked for length. The message is flagged for rejection if the Date header is more than 60 characters in length. If a Content-Type header is found, the program looks in it for the definition of a boundary.

• If a boundary definition is found, the filter program scans the body of the message looking for occurrences of that boundary (this is done even if the message has already been flagged for rejection, so that all the possible causes of rejection are found). Whenever it finds a boundary, the program reads the subsequent MIME part headers, and subjects each one to the same test as the main message headers. Again, the message is flagged for rejection if a match is found.

  (If the body of the message is longer than 65,535 characters, Sendmail passes it to the filter in "chunks" of no more than that size. When scanning the message body, the filter "overlaps" adjacent chunks in order to detect boundaries and suspect text strings which would otherwise be split between chunks.)

• While a message is being processed it is stored in a "temporary" file. If the message is rejected, this file is renamed and made permanent. The name of this file then incorporates the username part of the sender's e-mail address. The file contains the complete text of the message, annotated to identify each string which caused the message to be rejected and the header in which it occurred.

• If a message is rejected, the filter provides Sendmail with an SMTP reply to return to the sender, informing them that the message could not be delivered and giving the reason.

• Acceptance or rejection of the message is recorded in the system log.

Rejected Message Files

The name of the file will consist of the "username" part of the sender's e-mail address and a "random" string of characters. For example, a rejected message from A.N.Other@some.co.uk may be saved as "A.N.Other.aawfiA".

The file contains the text of the message, annotated as follows:-

• A diagnostic note will appear at the end of the message or, in a long message, at the end of each "chunk" of 65,535 characters, e.g.

  =====================================================
  Note inserted by Ray's Mail Filter
  -----------------------------------------------------
  This chunk (bodylen):    65535
  Overlap from previous:       0
  Buffer contains:         65535
  Overlap to next chunk:    1024
  =====================================================
  

• If a suspect string occurs in one of the main message headers, (or the Date header is found to be suspiciously long), a note is inserted into the file immediately after the offending header, e.g.

  Message-ID: <20000626101717.2799.qmail@ab.cdefg.com>
  From: lists@wxyz.com
  To: A.Student@sbu.ac.uk
  Subject: Mail from Jokes Online
  -----------------------------------------------------
  Ray's Mail Filter found the following pattern:
  :_ Jokes
  in this header:
  Subject: Mail from Jokes Online
  -----------------------------------------------------
  Reply-to: lists@wxyz.com
  X-Mailer: WXYZ-Mailing List Service
  

• If a suspect string occurs in a MIME header, it will be reported in the diagnostic note at the end of the 64kB chunk in which the MIME header occurs, e.g.

  =====================================================
  Note inserted by Ray's Mail Filter
  -----------------------------------------------------
  This chunk (bodylen):    65535
  Overlap from previous:       0
  Buffer contains:         65535
  -----------------------------------------------------
  Ray's Mail Filter found the following pattern:
  :_ name=\".*\.exe\"
  in this header:
  Content-Type: application/octet-stream;
          name="Beckham.exe"
  
  -----------------------------------------------------
  Overlap to next chunk:    1024
  =====================================================
  

SMTP reply

554 5.7.1 Message was rejected because it contains signs of a possible virus (name=\".*\.vbs\")

This consists of the following components:-

• The RFC 821 three-digit reply code 554 (Transaction failed)

• The RFC 1893 / RFC 2034 extended reply code 5.7.1:-
  • 5 = Permanent failure;
  • 7 = Security or policy status;
  • 1 = Delivery not authorised, message refused.

• A text message which can be specified at compile time (default message shown above).

• The suspect string(s) which caused the message to be rejected are appended to the text message as a comma-separated list in brackets.

Log files

mail-filter.log records when the filter is started, stopped or signalled to re-read its configuration files, e.g.

21-Jun-2000 11:19:46 : Starting rays-filter; FAIL_COUNT = 0
28-Jun-2000 14:35:17 : Signalling rays-filter to read configuration files
04-Jul-2000 16:31:49 : Stopping rays-filter; WAIT = 6

The filter makes entries in the system log file using the following function calls:

openlog("rays-filter", LOG_PID, LOG_USER);

syslog(LOG_INFO, "text");

Program starting

Read 3 header names from /usr/local/src/mail-filters/header_list.conf

Read 48 strings from /usr/local/src/mail-filters/string_list.conf

Accepted message: From: <a.n.other@sbu.ac.uk> To: <some.body@talk21.com> Subject: medical stories

*Rejected message: From: <some.one@somewhere.ac.uk> To: <butlerra@sbu.ac.uk> Subject: Test

Known Bugs

Interaction with Other Software

Release Notes

Installing the Filter
Filter Configuration
Running the Filter
Utilities