Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

The 

attachment-filename

 rule checks the filenames of each attachment in a message to see if it matches 

the given regular expression. This comparison is case-sensitive. The comparison is, however sensitive to 
whitespace so if the filename has encoded whitespace at the end, the filter will skip the attachment. If 
one of the message’s attachments matches the filename, this rule returns “true.”

Please note the following points: 

Each attachment’s filename is captured from the MIME headers. The filename in the MIME header 
may contain trailing spaces.

If an attachment is an archive, the Cisco appliance will harvest the filenames from inside the archive, 
and apply scan configuration rules (see 

) accordingly. 

If the attachment is a single compressed file (despite the file extension), it is not considered an 
archive and the filename of the compressed file is not harvested. This means that the file is not 
processed by the 

attachment-filename

 rule. An example of this type of file is an executable 

file (.exe) compressed with 

gzip

.

For attachments consisting of a single compressed file, such as foo.exe.gz, use regular 
expression to search for specific file types within compressed files. See 

See 

 for more information on message filter rules you can use to 

manipulate attachments to messages. 

The following filter checks all email sent through the listener, and if a message contains an attachment 
with a filename 

*.mp3

, the message is bounced:

This example shows how to match single compressed files in archives such as those created by 

gzip

:

        bounce();

   }

block_mp3s:

   if (attachment-filename == '(?i)\\.mp3$') {

        bounce();

   }

quarantine_gzipped_exe_or_pif:

if (attachment-filename == '(?i)\\.(exe|pif)($|.gz$)') {