MailFront

SMTP Front Ends

Mailfront Patterns Specification


The pattern matching feature of mailfront provides an ability for rejecting messages based on simple patterns in their content. If $PATTERNS is set, the named file is loaded and and parsed (see below), and pattern matching is enabled. No more than $PATTERNS_LINEMAX bytes (defaults to 256) are added to the line buffer before the pattern matching is done. If any pattern matches, the message data is rejected with a message taken from $PATTERNS_RESP (defaults to "This message contains prohibited content").

The patterns file contains a list of standard glob-style patterns. Each line of the file starts with a control character, which is not part of the pattern itself. Blank lines and lines beginning with "#" are ignored as comments. Lines beginning with "=" set the response given when a message is rejected, effective for all following patterns, until another response line is seen. Lines beginning with "\" match only immediately after a blank line. Lines beginning with any other character match any non-blank line.

The following patterns list is a much simplified version of Russell Nelson's qmail-smtpd virus scan patch. In particular, it doesn't actually do any kind of checking if the blank line really marked a MIME boundary or not.

=We don't accept email with executable content (#5.3.4)
\TVqQAAMAA*
\TVpQAAIAA*
\TVpAALQAc*
\TVpyAXkAX*
\TVrmAU4AA*
\TVrhARwAk*
\TVoFAQUAA*
\TVoAAAQAA*
\TVoIARMAA*
\TVouARsAA*
\TVrQAT8AA*
\TVoAAAEAAA*