Delete with MailScanner based on header

[Alvaro Marín]

Hi Jules,

I'm using Cloudmark's plugin for SA. In SA, I configure:

ifplugin Mail::SpamAssassin::Plugin::CMAE
        full        CMAE_1  eval:check_msg()
        describe    CMAE_1  Cloudmark CMAE detected spam
        score       CMAE_1  5
	add_header all CMAE-Analysis  _CMAETAG_
endif

that has a score of 5 if the message is cataloged like spam and adds a
header like this:

X-Spam-CMAE-Analysis: v=1.0 c=1 p=J1lT5JFMR5d2qjHey-wA:9
         p=3b90pLas9PL642u5t7TVoAw98R4A:4 p=9d3U-zX9zcfjglhJKlcA:9

The problem is that if the plugin detects a virus in the message, this
header changes to:

X-Spam-CMAE-Analysis: v=1.0 c=1 p=J1lT5JFMR5d2qjHey-wA:9
         p=3b90pLas9PL642u5t7TVoAw98R4A:4 p=9d3U-zX9zcfjglhJKlcA:9
xcat=Virus/CMU_7796_20090511

adding that "xcat" field.

I want to delete messages with "xcat=Virus" and other messages, mark
them with {Spam?}.
If I could see in a MailScanner plugin this header that SA returns, I
would be able to mark it to delete in case that has "xcat=Virus". Is it
possible?

Thanks!


Julian Field escribió:
> 
> 
> On 13/05/2009 12:53, Alvaro Marín wrote:
>> Hello,
>>
>> I'm using a plugin in SA that does an "eval:check_msg()" and adds a
>> header
>> with add_header. In that header there is information about the scanned
>> mail (if it's spam
>> or a virus).
>>
>> I see that isn't any option in MailScanner's configuration to do an
>> action based on a header added by SA, something like "SpamAssassin Rule
>> Actions", so I've thought to do a custom function for MailScanner to
>> do it.
>> The idea is see if this header has "virus" as value, and if this occurs,
>> delete the message. Is this possible?
>> Where are SA's headers stored (I see that $message->{headers} are
>> original ones only)?
>>    
> MailScanner does not allow SpamAssassin to modify the message. However,
> you can have a SA rule and then have a "header" action in the
> SpamAssassin Rule Actions setup.
> 
> SpamAssassin is the wrong tool for determining if a message is a virus.
> Maybe you want to use the "generic" virus scanner that MailScanner
> allows you to implement yourself?
> 
> Jules
> 


-- 
Alvaro Marín Illera
Hostalia Internet
www.hostalia.com