Vulnerability Development mailing list archives
Help me audit a mail filter in C, please?
From: bet () RAHUL NET (Bennett Todd)
Date: Thu, 4 May 2000 23:50:23 -0400
I've written the teensiest, tinyest little C program I could manage to do email filtering. Tomorrow I'm gonna start into figuring out how to integrate this gizmo into Postfix. My plan is that this thing _just_ checks, for messages small enough to fit into a reasonable in-memory buffer (1MB by default) whether they contain a match for any of the regexps in a file. If a match is found, or if the file is too large to buffer in memory all at once, then it barfs it out into a directory for some other program to deal with; I'll write a daemon for the few that this snaggles, probably in perl. This way the vast majority of messages will be as fast as possible. I've already figured out that I'll need to do a write-to-tmp-and-rename to clue in the daemon when the write is really finished, and I'm sure I'll be needing to do something appropriate with command-line args, or maybe envars, and popen a /usr/lib/sendmail to send the thing on if it passes the tests. But basically the hard part of the job should be done now. I would really appreciate it if any of you can turn up any problems with this. Or even if you can't. Appreciate as in add names to the README and the AUTHOR section of the man page. -Bennett <HR NOSHADE> <UL> <LI>application/x-gzip attachment: mailfilt-1.0.tar.gz </UL> <HR NOSHADE> <UL> <LI>application/pgp-signature attachment: stored </UL>
Current thread:
- Re: New worm?, (continued)
- Re: New worm? 3APA3A (May 04)
- I Love you virus cure for exchange server NT sven (May 04)
- "I Love You" worm Voodoo Chile (May 04)
- Re: New worm? Ron DuFresne (May 04)
- Re: New worm? Bluefish (May 04)
- lovethingy spread analyses Roelof Temmingh (May 04)
- I love you. Blue Boar (May 04)
- Re: ethernet cards & promisc mode C.J. Oster (May 04)
- Re: ethernet cards & promisc mode Stuart Henderson (May 04)
- Re: ethernet cards & promisc mode Granquist, Lamont (May 04)
- Help me audit a mail filter in C, please? Bennett Todd (May 04)
- Re: ethernet cards & promisc mode David LaPorte (May 04)
- Re: ethernet cards & promisc mode Granquist, Lamont (May 05)
- Re: ethernet cards & promisc mode Bluefish (May 07)
- "I don't think I really love you" Michal Zalewski (May 07)
- Re: ethernet cards & promisc mode Granquist, Lamont (May 07)
- Possible new strain of [CENSORED] Blue Boar (May 05)
- Re: ethernet cards & promisc mode Dragos Ruiu (May 04)
- Opportunist? Blue Boar (May 04)
- Re: Opportunist? Andreas Ferber (May 05)
- Reminder: MaxClientRequestBuffer Marc (May 03)