[Mimedefang] Where in the filter is the virus scanner called?

[Anthony Giggins]

OK, but you didn't answer my other question can you also block by Sender
and/or attachment extension and maybe even via Subject in filter begin.
Before the message is actually scanned.

I'm attempting to cut down on as much over head as possible so
performing all these blocks before the message is scanned will cut down
on as much as possible and will only call the virus scanner as a last
ditched effort to protect users.

Cheers

-----Original Message-----
From: mimedefang-admin at lists.roaringpenguin.com
[mailto:mimedefang-admin at lists.roaringpenguin.com] On Behalf Of David F.
Skoll
Sent: Friday, 19 April 2002 9:23 PM
To: 'mimedefang at lists.roaringpenguin.com'
Subject: Re: [Mimedefang] Where in the filter is the virus scanner
called?

On Fri, 19 Apr 2002, Anthony Giggins wrote:

> Is virus scanner called from filter_begin or filter

Again, it's up to you.  You should probably call one of the
message_contains_virus_* functions in filter_begin.  If you reject
the message, don't bother calling any virus-related functions in filter.

If you just want to remove the infected part, then call
entity_contains_virus_* inside filter (but don't do it unless
message_contains_virus_* found something.)

Example 1: We bounce messages containing viruses.

sub filter_begin {
	if (message_contains_virus_xxx()) {
		return action_bounce("Virus found");
	}
}


Example 2: We quarantine virus-bearing attachments.

sub filter_begin {
	$FoundVirus = message_contains_virus_xxx();
}

sub filter {
	if ($FoundVirus && entity_contains_virus_xxx($entity)) {
		return action_quarantine($entity, "Virus found");
	}
}

Regards,

David.

_______________________________________________
MIMEDefang mailing list
MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang