From 3851980c3810eee036c28ba3d3bb78ea6c5f2551 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ask=20Bj=C3=B8rn=20Hansen?= Date: Thu, 9 May 2002 23:47:20 +0000 Subject: [PATCH] klez filter (thanks to robert spier) git-svn-id: https://svn.perl.org/qpsmtpd/trunk@19 958fd67b-6ff1-0310-b445-bb7760255be9 --- Changes | 3 +++ qpsmtpd | 12 ++++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/Changes b/Changes index 8e2d04c..f979637 100644 --- a/Changes +++ b/Changes @@ -1,3 +1,6 @@ +2002/05/09 + Klez filter (thanks to Robert Spier) + 2002/04/20 Bumped version number to 0.07 diff --git a/qpsmtpd b/qpsmtpd index fe52680..ce23ce9 100755 --- a/qpsmtpd +++ b/qpsmtpd @@ -11,7 +11,7 @@ # package QPsmtpd; -$QPsmtpd::VERSION = "0.07"; +$QPsmtpd::VERSION = "0.07b"; use strict; $| = 1; use Mail::Address (); @@ -130,7 +130,7 @@ sub mail { warn "$$ full from_parameter: $from_parameter\n" if $TRACE; my ($from) = ($from_parameter =~ m/^from:\s*(\S+)/i)[0]; #warn "$$ from email address : $from\n" if $TRACE; - if ($from eq "<>") { + if ($from eq "<>" or $from =~ m/\[undefined\]/) { $from = Mail::Address->new("<>"); } else { @@ -214,6 +214,14 @@ sub data { } + # Might be klez + m/^Content-type:.*(?:audio|application)/i + and $matches{"klez"}=1; + + # we've seen the Klez signature, we're probably infected + $blocked = q[Take your Klez virus and stuff it! HAND.] + if $matches{"klez"} and m!^TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQA!; + $buffer .= $_; $size += length $_; }