[Rspamd-Users] Block File by type or extantion

[Vsevolod Stakhov]

On 10/12/2018 19:58, Tim Harman via Users wrote:
> On 11/12/2018 8:51 am, Koby Peleg Hen wrote:
> 
>> This is file name not file type. 
>> I am looking for block by file type like mailscanner.
> 
> Please don't top-reply on this list. 
> 
> You can block by extension, which is basically filetype.  Of course it's
> possible to rename a zip to pdf etc to bypass this. 
> 
> Are you saying that mailscanner performs heuristics on the file to
> determine it's type, ignoring whatever extn it has? rspamd doesn't do
> this and while I can't actually speak for the author, I doubt it ever
> will.  I think it would slow down processing too much.
> 

Rspamd has some heuristic about archives and images. I think I can add
something more. In theory, Rspamd is linked against libmagic. However, I
doubt its performance would be sufficient and many file types are just
useless in the vast majority of the cases. I have the task to
investigate libmagic performance and consider moving some of the parts
towards hyperscan in my short term plans at least.