byterazor/qpsmtpd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

klez filter (thanks to robert spier)

Browse Source 
git-svn-id: https://svn.perl.org/qpsmtpd/trunk@19 958fd67b-6ff1-0310-b445-bb7760255be9
This commit is contained in:
Ask Bjørn Hansen 2002-05-09 23:47:20 +00:00
parent 54365fa0ac
commit 3851980c38
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Changes
View File

@ -1,3 +1,6 @@
2002/05/09
Klez filter (thanks to Robert Spier)
2002/04/20 2002/04/20
Bumped version number to 0.07 Bumped version number to 0.07

12
qpsmtpd
View File

@ -11,7 +11,7 @@
# #
package QPsmtpd; package QPsmtpd;
$QPsmtpd::VERSION = "0.07"; $QPsmtpd::VERSION = "0.07b";
use strict; use strict;
$| = 1; $| = 1;
use Mail::Address (); use Mail::Address ();
@ -130,7 +130,7 @@ sub mail {
warn "$$ full from_parameter: $from_parameter\n" if $TRACE; warn "$$ full from_parameter: $from_parameter\n" if $TRACE;
my ($from) = ($from_parameter =~ m/^from:\s*(\S+)/i)[0]; my ($from) = ($from_parameter =~ m/^from:\s*(\S+)/i)[0];
#warn "$$ from email address : $from\n" if $TRACE; #warn "$$ from email address : $from\n" if $TRACE;
if ($from eq "<>") { if ($from eq "<>" or $from =~ m/\[undefined\]/) {
$from = Mail::Address->new("<>"); $from = Mail::Address->new("<>");
} }
else { else {
@ -214,6 +214,14 @@ sub data {
} }
# Might be klez
m/^Content-type:.*(?:audio|application)/i
and $matches{"klez"}=1;
# we've seen the Klez signature, we're probably infected
$blocked = q[Take your Klez virus and stuff it! HAND.]
if $matches{"klez"} and m!^TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQA!;
$buffer .= $_; $buffer .= $_;
$size += length $_; $size += length $_;
} }