Re: Incoming feed statistics

Jeffrey M Vinocur <jeff@xxxxxxxxxx> writes:

> Ho hum, so it is stealth binary yEnc stuff, but I don't know why
> Cleanfeed isn't catching it.

> The body of <7Iwua.566403$0M1.560376@xxxxxxxxxxxxxxxxxxxx> begins

>>>> =ybegin part=2 line=128 size=10485760 name=[VE] Rurouni ...

> but it's apparently not getting caught by the yEnc filter I snarfed from
> Russ a while back (but looks like it should match just fine, unless my
> understanding of Perl is completely broken).

Rejected here:

newsfeed:~/log> fgrep '<7Iwua.566403$0M1.560376@xxxxxxxxxxxxxxxxxxxx>' news
May  8 10:44:53.971 - news.isc.org 
<7Iwua.566403$0M1.560376@xxxxxxxxxxxxxxxxxxxx> 437 Binary in non-binary group

The filter I'm using is:

# How we determine if a post is a binary.
sub is_binary {
    if ($hdr{__BODY__} =~ m%^=ybegin (.+)$%m) {
        local $_ = $1;
        if (/line=/ && /size=/ && /name=/) {
            return 1;
        }
    }
    ($hdr{__BODY__} =~ m%(?:^[ \t>]*(?>M[\x20-\x60]{59,60})[ \r]*\n){40}%m
     || $hdr{__BODY__} =~ m%(?:^[ \t>]*[A-Za-z0-9+/]{59,76}[ \r]*\n){40}%m);
}

-- 
Russ Allbery (rra@xxxxxxxxxxxx)             <http://www.eyrie.org/~eagle/>

    Please send questions to the list rather than mailing me directly.
     <http://www.eyrie.org/~eagle/faqs/questions.html> explains why.