Query: Deep Packet Inspection?

Submitted by paddyjoesoap on Wed, 2010-06-23 08:14

General discussion

Hi all,

Does ejabberd support message content filtering?

For example, can it perform deep stanza inspection to filter/block messages with certain keywords or URL's?

One example, might be to prevent a phishing attack by blocking any message with the string "www.paypa1.com" where the "l" is replaced with a "1".

regards,
paddy.

Not implemented that exactly.

Submitted by badlop on Thu, 2010-06-24 10:28.

Not implemented that exactly. What there is is:

Block stanzas based in their type (message, presence, iq), their destination or their sender: http://www.ejabberd.im/mod_filter
Modify message stanzas that contain certain words: http://www.dtek.chalmers.se/~henoch/mod_shit.erl

You could implement a new feature in any of those modules: analyze the body of each message stanza, and either let it pass, drop it, or prepend the message body with a sentence like "Warning: this message is probably a phising attack."