From cac487301d0cca450782f71990f10d66ccfac8f1 Mon Sep 17 00:00:00 2001
From: "Adam D. Barratt" <adam@adam-barratt.org.uk>
Date: Thu, 24 Oct 2019 22:06:36 +0100
Subject: [PATCH] eximconf: tag/reject mail matching specific suspicious
 content

This initial string matches an unsubscribe link using the text "if you...
were unknowingly or unintentionally added to the mailing list"

Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
---
 modules/exim/templates/eximconf.erb | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index eb28176e2..3d5b570b7 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -1068,6 +1068,30 @@ check_message:
           condition       = ${if !eq {$acl_m_prf}{PopconMail}}
 	  message         = Your mailer is not RFC 2047 compliant: message rejected
 
+  discard condition      = ${if eq {$acl_m_prf}{blackhole}}
+          condition      = ${if bool_lax{$acl_m_defopt}}
+          condition      = ${if or {\
+                                    {match {$message_body}{Wenn Sie zuk&uuml;nftig keine weiteren Informationen erhalten m&ouml;chten, <br />unwissentlich oder unbeabsichtigt in den Verteiler aufgenommen wurden,}} \
+                                   }\
+                            }
+          log_message    = Discarded suspicious content for $recipients
+
+  deny    condition      = ${if !eq {$acl_m_prf}{markup}}
+          condition      = ${if bool_lax{$acl_m_defopt}}
+          condition      = ${if or {\
+                                    {match {$message_body}{Wenn Sie zuk&uuml;nftig keine weiteren Informationen erhalten m&ouml;chten, <br />unwissentlich oder unbeabsichtigt in den Verteiler aufgenommen wurden,}} \
+                                   }\
+                            }
+          message        = Rejected due to suspicious content
+
+  warn    condition      = ${if eq {$acl_m_prf}{markup}}
+          condition      = ${if bool_lax{$acl_m_defopt}}
+          condition      = ${if or {\
+                                    {match {$message_body}{Wenn Sie zuk&uuml;nftig keine weiteren Informationen erhalten m&ouml;chten, <br />unwissentlich oder unbeabsichtigt in den Verteiler aufgenommen wurden,}} \
+                                   }\
+                            }
+          add_header     = X-debian-content-warning: yes
+
 <%- if has_variable?("clamd") && @clamd -%>
   discard condition       = ${if eq {$acl_m_prf}{blackhole}}
           malware         = */defer_ok
-- 
2.20.1