#++
# NAME
# header_checks 5
# SUMMARY
# Postfix built-in content inspection
# SYNOPSIS
# .nf
# \fBheader_checks = pcre:/etc/postfix/header_checks\fR
# \fBmime_header_checks = pcre:/etc/postfix/mime_header_checks\fR
# \fBnested_header_checks = pcre:/etc/postfix/nested_header_checks\fR
# \fBbody_checks = pcre:/etc/postfix/body_checks\fR
# .sp
# \fBmilter_header_checks = pcre:/etc/postfix/milter_header_checks\fR
# .sp
# \fBsmtp_header_checks = pcre:/etc/postfix/smtp_header_checks\fR
# \fBsmtp_mime_header_checks = pcre:/etc/postfix/smtp_mime_header_checks\fR
# \fBsmtp_nested_header_checks = pcre:/etc/postfix/smtp_nested_header_checks\fR
# \fBsmtp_body_checks = pcre:/etc/postfix/smtp_body_checks\fR
# .sp
# \fBpostmap -q "\fIstring\fB" pcre:/etc/postfix/\fIfilename\fR
# \fBpostmap -q - pcre:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
# .fi
# DESCRIPTION
# This document describes access control on the content of
# message headers and message body lines; it is implemented
# by the Postfix \fBcleanup\fR(8) server before mail is queued.
# See \fBaccess\fR(5) for access control on remote SMTP client
# information.
#
# Each message header or message body line is compared against
# a list of patterns.
# When a match is found the corresponding action is executed, and
# the matching process is repeated for the next message header or
# message body line.
#
# Note: message headers are examined one logical header at a time,
# even when a message header spans multiple lines. Body lines are
# always examined one line at a time.
#
# For examples, see the EXAMPLES section at the end of this
# manual page.
#
# Postfix header or body_checks are designed to stop a flood of mail
# from worms or viruses; they do not decode attachments, and they do
# not unzip archives. See the documents referenced below in the README
# FILES section if you need more sophisticated content analysis.
# FILTERS WHILE RECEIVING MAIL
# .ad
# .fi
# Postfix implements the following four built-in content
# inspection classes while receiving mail:
# .IP "\fBheader_checks\fR (default: empty)"
# These are applied to initial message headers (except for
# the headers that are processed with \fBmime_header_checks\fR).
# .IP "\fBmime_header_checks\fR (default: \fB$header_checks\fR)"
# These are applied to MIME related message headers only.
# .sp
# This feature is available in Postfix 2.0 and later.
# .IP "\fBnested_header_checks\fR (default: \fB$header_checks\fR)"
# These are applied to message headers of attached email
# messages (except for the headers that are processed with
# \fBmime_header_checks\fR).
# .sp
# This feature is available in Postfix 2.0 and later.
# .IP \fBbody_checks\fR
# These are applied to all other content, including multi-part
# message boundaries.
# .sp
# With Postfix versions before 2.0, all content after the initial
# message headers is treated as body content.
# FILTERS AFTER RECEIVING MAIL
# .ad
# .fi
# Postfix supports a subset of the built-in content inspection
# classes after the message is received:
# .IP "\fBmilter_header_checks\fR (default: empty)"
# These are applied to headers that are added with Milter
# applications.
# .sp
# This feature is available in Postfix 2.7 and later.
# FILTERS WHILE DELIVERING MAIL
# .ad
# .fi
# Postfix supports all four content inspection classes while
# delivering mail via SMTP.
# .IP "\fBsmtp_header_checks\fR (default: empty)"
# .IP "\fBsmtp_mime_header_checks\fR (default: empty)"
# .IP "\fBsmtp_nested_header_checks\fR (default: empty)"
# .IP "\fBsmtp_body_checks\fR (default: empty)"
# These features are available in Postfix 2.5 and later.
# COMPATIBILITY
# .ad
# .fi
# With Postfix version 2.2 and earlier specify "\fBpostmap
# -fq\fR" to query a table that contains case sensitive
# patterns. By default, regexp: and pcre: patterns are case
# insensitive.
# TABLE FORMAT
# .ad
# .fi
# This document assumes that header and body_checks rules are specified
# in the form of Postfix regular expression lookup tables. Usually the
# best performance is obtained with \fBpcre\fR (Perl Compatible Regular
# Expression) tables. The \fBregexp\fR (POSIX regular
# expressions) tables are usually slower, but more widely
# available.
# Use the command "\fBpostconf -m\fR" to find out what lookup table
# types your Postfix system supports.
#
# The general format of Postfix regular expression tables is
# given below.
# For a discussion of specific pattern or flags syntax,
# see \fBpcre_table\fR(5) or \fBregexp_table\fR(5), respectively.
# .IP "\fB/\fIpattern\fB/\fIflags action\fR"
# When /\fIpattern\fR/ matches the input string, execute
# the corresponding \fIaction\fR. See below for a list
# of possible actions.
# .IP "\fB!/\fIpattern\fB/\fIflags action\fR"
# When /\fIpattern\fR/ does \fBnot\fR match the input string,
# execute the corresponding \fIaction\fR.
# .IP "\fBif /\fIpattern\fB/\fIflags\fR"
# .IP "\fBendif\fR"
# If the input string matches /\fIpattern\fR/, then match that
# input string against the patterns between \fBif\fR and
# \fBendif\fR. The \fBif\fR..\fBendif\fR can nest.
# .sp
# Note: do not prepend whitespace to patterns inside
# \fBif\fR..\fBendif\fR.
# .IP "\fBif !/\fIpattern\fB/\fIflags\fR"
# .IP "\fBendif\fR"
# If the input string does not match /\fIpattern\fR/, then
# match that input string against the patterns between \fBif\fR
# and \fBendif\fR. The \fBif\fR..\fBendif\fR can nest.
# .IP "blank lines and comments"
# Empty lines and whitespace-only lines are ignored, as
# are lines whose first non-whitespace character is a `#'.
# .IP "multi-line text"
# A pattern/action line starts with non-whitespace text. A line that
# starts with whitespace continues a logical line.
# TABLE SEARCH ORDER
# .ad
# .fi
# For each line of message input, the patterns are applied in the
# order as specified in the table. When a pattern is found that matches
# the input line, the corresponding action is executed and then the
# next input line is inspected.
# TEXT SUBSTITUTION
# .ad
# .fi
# Substitution of substrings from the matched expression into the
# \fIaction\fR
# string is possible using the conventional Perl syntax
# (\fB$1\fR, \fB$2\fR, etc.).
# The macros in the result string may need to be written as \fB${n}\fR
# or \fB$(n)\fR if they aren't followed by whitespace.
#
# Note: since negated patterns (those preceded by \fB!\fR) return a
# result when the expression does not match, substitutions are not
# available for negated patterns.
# ACTIONS
# .ad
# .fi
# Action names are case insensitive. They are shown in upper case
# for consistency with other Postfix documentation.
# .IP "\fBBCC \fIuser@domain\fR"
# Add the specified address as a BCC recipient, and inspect
# the next input line. The address
# must have a local part and domain part. The number of BCC
# addresses that can be added is limited only by the amount
# of available storage space.
#
# Note 1: the BCC address is added as if it was specified with
# NOTIFY=NONE. The sender will not be notified when the BCC
# address is undeliverable, as long as all down-stream software
# implements RFC 3461.
#
# Note 2: this ignores duplicate addresses (with the same
# delivery status notification options).
# .sp
# This feature is available in Postfix 3.0 and later.
# .sp
# This feature is not supported with smtp header/body checks.
# \" .IP "\fBDELAY \fItime\fR"
# \" Place the message into the deferred queue, and delay the
# \" initial delivery attempt by \fItime\fR. The time value may
# \" be followed by a one-character suffix that specifies the
# \" time unit: s (seconds), m (minutes), h (hours), d (days),
# \" w (weeks). The default time unit is s (seconds).
# \" .sp
# \" Limitations:
# \" .RS
# \" .IP \(bu
# \" This action affects all the recipients of the message.
# \" .IP \(bu
# \" The delay value has no effect with remote file systems that
# \" don't correctly emulate UNIX local file system semantics.
# \" In that case, the delay will be half of $queue_run_delay
# \" on average.
# \" .IP \(bu
# \" Mail will still be delivered with "sendmail -q", "postfix
# \" flush" or "postqueue -f".
# \" .IP \(bu
# \" Delayed mail increases the amount of disk I/O during deferred
# \" queue scans. When large amounts of mail are queued for
# \" delayed delivery it may be preferable to use the HOLD feature
# \" instead.
# \" .RE
# \" .IP
# \" This feature is available in Postfix 2.3 and later.
# .IP "\fBDISCARD \fIoptional text...\fR"
# Claim successful delivery and silently discard the message.
# Do not inspect the remainder of the input message.
# Log the optional text if specified, otherwise log a generic
# message.
# .sp
# Note: this action disables further header or body_checks inspection
# of the current message and affects all recipients.
# To discard only one recipient without discarding the entire message,
# use the transport(5) table to direct mail to the discard(8) service.
# .sp
# This feature is available in Postfix 2.0 and later.
# .sp
# This feature is not supported with smtp header/body checks.
# .IP \fBDUNNO\fR
# Pretend that the input line did not match any pattern, and inspect the
# next input line. This action can be used to shorten the table search.
# .sp
# For backwards compatibility reasons, Postfix also accepts
# \fBOK\fR but it is (and always has been) treated as \fBDUNNO\fR.
# .sp
# This feature is available in Postfix 2.1 and later.
# .IP "\fBFILTER \fItransport:destination\fR"
# Override the content_filter parameter setting, and inspect
# the next input line.
# After the message is queued, send the entire message through
# the specified external content filter. The \fItransport\fR
# name specifies the first field of a mail delivery agent
# definition in master.cf; the syntax of the next-hop
# \fIdestination\fR is described in the manual page of the
# corresponding delivery agent. More information about
# external content filters is in the Postfix FILTER_README
# file.
# .sp
# Note 1: do not use $\fInumber\fR regular expression
# substitutions for \fItransport\fR or \fIdestination\fR
# unless you know that the information has a trusted origin.
# .sp
# Note 2: this action overrides the main.cf \fBcontent_filter\fR
# setting, and affects all recipients of the message. In the
# case that multiple \fBFILTER\fR actions fire, only the last
# one is executed.
# .sp
# Note 3: the purpose of the FILTER command is to override
# message routing. To override the recipient's \fItransport\fR
# but not the next-hop \fIdestination\fR, specify an empty
# filter \fIdestination\fR (Postfix 2.7 and later), or specify
# a \fItransport:destination\fR that delivers through a
# different Postfix instance (Postfix 2.6 and earlier). Other
# options are using the recipient-dependent \fBtrans\%port\%_maps\fR
# or the sen\%der-dependent
# \fBsender\%_de\%pen\%dent\%_de\%fault\%_trans\%port\%_maps\fR
# features.
# .sp
# This feature is available in Postfix 2.0 and later.
# .sp
# This feature is not supported with smtp header/body checks.
# .IP "\fBHOLD \fIoptional text...\fR"
# Arrange for the message to be placed on the \fBhold\fR queue,
# and inspect the next input line. The message remains on \fBhold\fR
# until someone either deletes it or releases it for delivery.
# Log the optional text if specified, otherwise log a generic
# message.
#
# Mail that is placed on hold can be examined with the
# \fBpostcat\fR(1) command, and can be destroyed or released with
# the \fBpostsuper\fR(1) command.
# .sp
# Note: use "\fBpostsuper -r\fR" to release mail that was kept on
# hold for a significant fraction of \fB$maximal_queue_lifetime\fR
# or \fB$bounce_queue_lifetime\fR, or longer. Use "\fBpostsuper -H\fR"
# only for mail that will not expire within a few delivery attempts.
# .sp
# Note: this action affects all recipients of the message.
# .sp
# This feature is available in Postfix 2.0 and later.
# .sp
# This feature is not supported with smtp header/body checks.
# .IP \fBIGNORE\fR
# Delete the current line from the input, and inspect
# the next input line. See \fBSTRIP\fR for an alternative
# that logs the action.
# .IP "\fBINFO \fIoptional text...\fR
# Log an "info:" record with the \fIoptional text...\fR (or
# log a generic text), and inspect the next input line. This
# action is useful for routine logging or for debugging.
# .sp
# This feature is available in Postfix 2.8 and later.
# .IP "\fBPASS \fIoptional text...\fR"
# Log a "pass:" record with the \fIoptional text...\fR (or
# log a generic text), and turn off header, body, and Milter
# inspection for the remainder of this message.
# .sp
# Note: this feature relies on trust in information that is
# easy to forge.
# .sp
# This feature is available in Postfix 3.2 and later.
# .sp
# This feature is not supported with smtp header/body checks.
# .IP "\fBPREPEND \fItext...\fR"
# Prepend one line with the specified text, and inspect the next
# input line.
# .sp
# Notes:
# .RS
# .IP \(bu
# The prepended text is output on a separate line, immediately
# before the input that triggered the \fBPREPEND\fR action.
# .IP \(bu
# The prepended text is not considered part of the input
# stream: it is not subject to header/body checks or address
# rewriting, and it does not affect the way that Postfix adds
# missing message headers.
# .IP \(bu
# When prepending text before a message header line, the prepended
# text must begin with a valid message header label.
# .IP \(bu
# This action cannot be used to prepend multi-line text.
# .RE
# .IP
# This feature is available in Postfix 2.1 and later.
# .sp
# This feature is not supported with milter_header_checks.
# .IP "\fBREDIRECT \fIuser@domain\fR"
# Write a message redirection request to the queue file, and
# inspect the next input line. After the message is queued,
# it will be sent to the specified address instead of the
# intended recipient(s).
# .sp
# Note 1: this action overrides the \fBFILTER\fR action, and affects
# all recipients of the message. If multiple \fBREDIRECT\fR actions
# fire, only the last one is executed.
# .sp
# Note 2: a REDIRECT address is subject to canonicalization
# (add missing domain) but NOT subject to canonical, masquerade,
# bcc, or virtual alias mapping.
# .sp
# This feature is available in Postfix 2.1 and later.
# .sp
# This feature is not supported with smtp header/body checks.
# .IP "\fBREPLACE \fItext...\fR"
# Replace the current line with the specified text, and inspect the next
# input line.
# .sp
# This feature is available in Postfix 2.2 and later. The
# description below applies to Postfix 2.2.2 and later.
# .sp
# Notes:
# .RS
# .IP \(bu
# When replacing a message header line, the replacement text
# must begin with a valid header label.
# .IP \(bu
# The replaced text remains part of the input stream. Unlike
# the result from the \fBPREPEND\fR action, a replaced message
# header may be subject to address rewriting and may affect
# the way that Postfix adds missing message headers.
# .RE
# .IP "\fBREJECT \fIoptional text...\fR
# Reject the entire message. Do not inspect the remainder of
# the input message. Reply with \fIoptional text...\fR when
# the optional text is specified, otherwise reply with a
# generic error message.
# .sp
# Note: this action disables further header or body_checks inspection
# of the current message and affects all recipients.
# .sp
# Postfix version 2.3 and later support enhanced status codes.
# When no code is specified at the beginning of \fIoptional
# text...\fR, Postfix inserts a default enhanced status code of
# "5.7.1".
# .sp
# This feature is not supported with smtp header/body checks.
# .IP "\fBSTRIP \fIoptional text...\fR"
# Log a "strip:" record with the \fIoptional text...\fR (or
# log a generic text), delete the input line from the input,
# and inspect the next input line. See \fBIGNORE\fR for a
# silent alternative.
# .sp
# This feature is available in Postfix 3.2 and later.
# .IP "\fBWARN \fIoptional text...\fR
# Log a "warning:" record with the \fIoptional text...\fR (or
# log a generic text), and inspect the next input line. This
# action is useful for debugging and for testing a pattern
# before applying more drastic actions.
# BUGS
# Empty lines never match, because some map types mis-behave
# when given a zero-length search string. This limitation may
# be removed for regular expression tables in a future release.
#
# Many people overlook the main limitations of header and body_checks
# rules.
# .IP \(bu
# These rules operate on one logical message header or one body
# line at a time. A decision made for one line is not carried over
# to the next line.
# .IP \(bu
# If text in the message body is encoded
# (RFC 2045) then the rules need to be specified for the encoded
# form.
# .IP \(bu
# Likewise, when message headers are encoded (RFC
# 2047) then the rules need to be specified for the encoded
# form.
# .PP
# Message headers added by the \fBcleanup\fR(8) daemon itself
# are excluded from inspection. Examples of such message headers
# are \fBFrom:\fR, \fBTo:\fR, \fBMessage-ID:\fR, \fBDate:\fR.
#
# Message headers deleted by the \fBcleanup\fR(8) daemon will
# be examined before they are deleted. Examples are: \fBBcc:\fR,
# \fBContent-Length:\fR, \fBReturn-Path:\fR.
# CONFIGURATION PARAMETERS
# .ad
# .fi
# .IP "\fBbody_checks (empty)\fR"
# Optional lookup tables for content inspection as specified in
# the \fBbody_checks\fR(5) manual page.
# .IP "\fBbody_checks_size_limit (51200)\fR"
# How much text in a message body segment (or attachment, if you
# prefer to use that term) is subjected to body_checks inspection.
# .IP "\fBheader_checks (empty)\fR"
# Optional lookup tables for content inspection of primary non-MIME
# message headers, as specified in the \fBheader_checks\fR(5) manual page.
# .IP "\fBmime_header_checks ($header_checks)\fR"
# Optional lookup tables for content inspection of MIME related
# message headers, as described in the \fBheader_checks\fR(5) manual page.
# .IP "\fBnested_header_checks ($header_checks)\fR"
# Optional lookup tables for content inspection of non-MIME message
# headers in attached messages, as described in the \fBheader_checks\fR(5)
# manual page.
# .IP "\fBdisable_mime_input_processing (no)\fR"
# Turn off MIME processing while receiving mail.
# EXAMPLES
# .ad
# .fi
# Header pattern to block attachments with bad file name
# extensions. For convenience, the PCRE /x flag is specified,
# so that there is no need to collapse the pattern into a
# single line of text. The purpose of the [[:xdigit:]]
# sub-expressions is to recognize Windows CLSID strings.
#
# .na
# .nf
# /etc/postfix/main.cf:
# header_checks = pcre:/etc/postfix/header_checks.pcre
#
# /etc/postfix/header_checks.pcre:
# /^Content-(Disposition|Type).*name\es*=\es*"?([^;]*(\e.|=2E)(
# ade|adp|asp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|
# hlp|ht[at]|
# inf|ins|isp|jse?|lnk|md[betw]|ms[cipt]|nws|
# \e{[[:xdigit:]]{8}(?:-[[:xdigit:]]{4}){3}-[[:xdigit:]]{12}\e}|
# ops|pcd|pif|prf|reg|sc[frt]|sh[bsm]|swf|
# vb[esx]?|vxd|ws[cfh]))(\e?=)?"?\es*(;|$)/x
# REJECT Attachment name "$2" may not end with ".$4"
# .ad
# .fi
#
# Body pattern to stop a specific HTML browser vulnerability exploit.
#
# .na
# .nf
# /etc/postfix/main.cf:
# body_checks = regexp:/etc/postfix/body_checks
#
# /etc/postfix/body_checks:
# /^<iframe src=(3D)?cid:.* height=(3D)?0 width=(3D)?0>$/
# REJECT IFRAME vulnerability exploit
# SEE ALSO
# cleanup(8), canonicalize and enqueue Postfix message
# pcre_table(5), format of PCRE lookup tables
# regexp_table(5), format of POSIX regular expression tables
# postconf(1), Postfix configuration utility
# postmap(1), Postfix lookup table management
# postsuper(1), Postfix janitor
# postcat(1), show Postfix queue file contents
# RFC 2045, base64 and quoted-printable encoding rules
# RFC 2047, message header encoding for non-ASCII text
# README FILES
# .ad
# .fi
# Use "\fBpostconf readme_directory\fR" or
# "\fBpostconf html_directory\fR" to locate this information.
# .na
# .nf
# DATABASE_README, Postfix lookup table overview
# CONTENT_INSPECTION_README, Postfix content inspection overview
# BUILTIN_FILTER_README, Postfix built-in content inspection
# BACKSCATTER_README, blocking returned forged mail
# LICENSE
# .ad
# .fi
# The Secure Mailer license must be distributed with this software.
# AUTHOR(S)
# Wietse Venema
# IBM T.J. Watson Research
# P.O. Box 704
# Yorktown Heights, NY 10598, USA
#
# Wietse Venema
# Google, Inc.
# 111 8th Avenue
# New York, NY 10011, USA
#--
