Yomi sandbox: Skip PEC attachments

nethesis / dev

Nethesis issue tracker

http://www.nethesis.it

4 stars 1 forks source link

Closed andre8244 closed 3 years ago

andre8244 commented 3 years ago

PEC attachments containing signature are sometimes mistakenly recognized as malware.

Proposed solution

Do not send PEC signatures to Yomi sandbox. openssl command can be used to properly detect if an attachment is a PEC signature

nethbot commented 3 years ago

in 7.9.2009/nethesis-testing:

andre8244 commented 3 years ago

Test case

Enable Yomi debug: config setprop yomi Debug enabled && signal-event nethserver-yomi-update
Send an email to test server containing a PEC signature as attachment, e.g. a .p7s file
Verify the following command returns a match: grep "skipped PEC signature" /var/log/maillog
Verify that delivered email contains YOMI_SKIPPED symbol with a proper description, e.g. YOMI_SKIPPED(0.00)[smime.p7s contains PEC signature]

nethbot commented 3 years ago

in 7.9.2009/nethesis-testing:

gsanchietti commented 3 years ago

Verified. When a p7s attachment is sent, the Yomi plugin will skip it:

Sep  9 12:30:59 server rspamd[29431]: <34ffc6>; lua; yomi.lua:83: yomi: skipped PEC signature smime.p7s

nethbot commented 3 years ago

in 7.9.2009/nethesis-updates: