Delete with MailScanner based on header

[Julian Field]

MailScanner doesn't allow SpamAssassin to modify the message, that would 
destroy the entire MIME structure and everything. It should be returning 
a rule hit for their plugin, not just adding a header.

On 14/05/2009 10:18, Alvaro Marín wrote:
> Hi Jules,
>
> I'm using Cloudmark's plugin for SA. In SA, I configure:
>
> ifplugin Mail::SpamAssassin::Plugin::CMAE
>          full        CMAE_1  eval:check_msg()
>          describe    CMAE_1  Cloudmark CMAE detected spam
>          score       CMAE_1  5
> 	add_header all CMAE-Analysis  _CMAETAG_
> endif
>
> that has a score of 5 if the message is cataloged like spam and adds a
> header like this:
>
> X-Spam-CMAE-Analysis: v=1.0 c=1 p=J1lT5JFMR5d2qjHey-wA:9
>           p=3b90pLas9PL642u5t7TVoAw98R4A:4 p=9d3U-zX9zcfjglhJKlcA:9
>
> The problem is that if the plugin detects a virus in the message, this
> header changes to:
>
> X-Spam-CMAE-Analysis: v=1.0 c=1 p=J1lT5JFMR5d2qjHey-wA:9
>           p=3b90pLas9PL642u5t7TVoAw98R4A:4 p=9d3U-zX9zcfjglhJKlcA:9
> xcat=Virus/CMU_7796_20090511
>
> adding that "xcat" field.
>
> I want to delete messages with "xcat=Virus" and other messages, mark
> them with {Spam?}.
> If I could see in a MailScanner plugin this header that SA returns, I
> would be able to mark it to delete in case that has "xcat=Virus". Is it
> possible?
>
> Thanks!
>
>
> Julian Field escribió:
>    
>>
>> On 13/05/2009 12:53, Alvaro Marín wrote:
>>      
>>> Hello,
>>>
>>> I'm using a plugin in SA that does an "eval:check_msg()" and adds a
>>> header
>>> with add_header. In that header there is information about the scanned
>>> mail (if it's spam
>>> or a virus).
>>>
>>> I see that isn't any option in MailScanner's configuration to do an
>>> action based on a header added by SA, something like "SpamAssassin Rule
>>> Actions", so I've thought to do a custom function for MailScanner to
>>> do it.
>>> The idea is see if this header has "virus" as value, and if this occurs,
>>> delete the message. Is this possible?
>>> Where are SA's headers stored (I see that $message->{headers} are
>>> original ones only)?
>>>
>>>        
>> MailScanner does not allow SpamAssassin to modify the message. However,
>> you can have a SA rule and then have a "header" action in the
>> SpamAssassin Rule Actions setup.
>>
>> SpamAssassin is the wrong tool for determining if a message is a virus.
>> Maybe you want to use the "generic" virus scanner that MailScanner
>> allows you to implement yourself?
>>
>> Jules
>>
>>      
>
>    

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.