We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.

Barracuda Email Security Gateway

How Can I Block, Quarantine or Tag mail based on the characters in a message and not the character set used.

  • Type: Knowledgebase
  • Date changed: one year ago
Solution #00006962  


Scope:


All Barracuda Spam Firewalls & Email Security Service, All firmware versions.


Answer:


On this website there are about 100 different language character classes. Cyrillic, Han (Japaneses, Chinese, Korean), Arabic and so on.


https://github.com/google/re2/wiki/Syntax


Using these character classes we can us a very simple re2 (regular expression) filter that will look for 4 characters in a row from a class and do whatever you want with it (allow, quarantine, block)

   [\p{Cyrillic}]{4}

   [\p{Han}]{4}

   [\p{Arabic}]{4}

These would be individual content filters on the Barracuda Spam Firewall (v6 and above) or in BESS.

Additionally: If you change the lower case p in the filters above to an upper case P the filter will work in reverse.

so this

   [\p{Cyrillic}] {4}

Will match against any 4 Cyrillic characters in a row and this

   [\P{Cyrillic}] {4}

Will match against any 4 characters in a row that are NOT Cyrillic.

And here are some slightly more complicated filters that you can use:

This catches all non-latin/ascii messages

   [^[:ascii:]\p{Latin}\pCc\pCf\pM\pZ\pP\pS]{4}

This catches all non-latin/asciii/Japanese/Chinese/Korean

   [^[:ascii:]\p{Latin}\p{Han}\pCc\pCf\pM\pZ\pP\pS]{4}

This catches all non-latin/ascii/Cyrillic

   [^[:ascii:]\p{Latin}\p{Cyrillic}\pCc\pCf\pM\pZ\pP\pS]{4}

visit https://github.com/google/re2/wiki/Syntax for a full list of all the character classes you can use.

This is the CORRECT configuration for these filters.

   [^[:ascii:]\p{Latin}\pCc\pCf\pM\pZ\pP\pS]{4}

   [\p{Cyrillic}]{4}

   [\p{Han}]{4}

   [\p{Arabic}]{4}

   [\p{Hiragana}]{4}

   [\p{Katakana}]{4}

These are INCORRECT configurations for these filters

   [\p{Cyrillic}]

   \p{Cyrillic}

NOTE: you should NOT select the ATTACHMENT option in ESS when adding the above filters. It WILL result in false positives. When adding these filters only select the SUBJECT, BODY and HEADER options to prevent false positives.

NOTE: The first filter above is the very best to use if the customer only accepts LATIN based email. It will stop just about everything else.

NOTE: It is important to add the {4} at the end of the filter. Lots of LATIN email has foreign charters in it. This requires that at least four (4) characters in a row are in the mail before it is caught.

NOTE: Y
ou can change the {4} to a higher or lower number to fine tune this filter to your specific needs

Link To This Page: