Filtering Attachments properly

[seteq]

Hi,

I'd like to use a filter rule to block Word and Powerpoint files even if they are inside archives, but it does not seem to work properly.
Sometimes there are messages which pass PMG and get caught by the forbidden file type rule on the Zimbra mail server.
As far as I understand the ruleset the message should be blocked on PMG.
Is this a malfunction because docx is technically a zip file with different file extension?



Tracking log:

Jun 28 08:46:36 mx1 pmg-smtp-filter[555024]: E09D962BAA3CC1D671: new mail message-id=<messageid@example.com>#012
Jun 28 08:46:36 mx1 pmg-smtp-filter[555024]: E09D962BAA3CC1D671: found archive 'DME-1.png.docx' (application/zip)
Jun 28 08:46:36 mx1 pmg-smtp-filter[555024]: E09D962BAA3CC1D671: unpack archive 'DME-1.png.docx' done (24 ms)
[...]
Jun 28 08:46:39 mx1 pmg-smtp-filter[555024]: E09D962BAA3CC1D671: accept mail to <recipient@mydomain.com> (44CF1E0AA8) (rule: default-accept)

Can somebody please explain what's happening here?

Thank you

 

[dcsapak]

the problem here is that the mimetype for the docx is probably detected as 'archive' or some sort (docx is a glorified zip with xml inside...)
you could add a 'match archive filename' rule in addition, this matches on filenames in archives