[Mimedefang] When do changes happen to INPUTMSG?

[Clayton, Nik [IT]]

Hi all,

I'm in the process of integrating a virus scanner in to an MD 
configuration.  It's not one of the existing scanners that MD 
supports[1].  I also need to run it over the entire message, since the 
vendor is unlikely to support it if we use anything other than their MIME
decomposition system during the scan.  So the usual trick of iterating
through the MIME parts that MD finds and scanning those one by one
isn't going to work.

So I figure I can just tell the scanner to scan the INPUTMSG file and
all will be well.  Any failures to decompose the MIME properly can be
shunted right back at the vendor.

However, since the existing MD configuration drops various attachment 
types (.exe, and so on) I want to run the scanner after the attachments 
have been dropped -- there's no point in having the scanner chew cycles 
scanning attachments that are going to be removed.

However, looking through the source, I don't think INPUTMSG gets rebuilt
until after filter_end() is called.  Since I plan on doing the scanning
filter_end(), this means I need to force INPUTMSG to be rebuilt first.

I've looked at action_rebuild(), but all that seems to do is set a flag
that the message should be rebuilt at the end of processing.  I want
the rebuild to happen immediately.

Looking through the code, I'm not sure MD can actually do what I want,
but confirmation (or rebuttal) would be useful...

N

[1] It's a locally written Perl wrapper around the SDK of one of the 
    AV engines used by one of the command line scanners that MD 
    supports.  Performance is, therefore, much better than a command 
    line scanner.  I'm trying to convince the vendor that there might be 
    some interest in this commercially...
-- 
1        1         2         3         4         5         6         7    7
         0         0         0         0         0         0         0    5
                                                    -- The 75 column-ometer
Global Messaging,                 A: Top posting
120 Cheapside, x83331             Q: What's the most annoying e-mail habit?