[Mimedefang] Filter question for perl guru

John Paul jpaul at kormanmarketing.com
Mon Jun 30 09:02:00 EDT 2003


First off, many thanks to David for such a fine product.

While most times I try (and usually succeed) to help myself by searching
the archives, I feel I'm at the point where I need to ask a question
finally.

Everything is working great. However I would like to confirm this
portion of my filter before I introduce it onto a live system.
I do use a small system at home to test with, but I can't seem to drum
up enough spam lately to see if this is working.
I'd rather get the opinions of a few of the perl gurus on the list
anyway.

I'd like to quarantine everything between 7 and 8.9 and discard
everything 9 and above.

Does the following look clean enough to use?

Oh, and being the rookie perl-butcher that I am, thanks in advance for
any opinions and/or suggestions offered.

John



sub filter_end ($) {
    my($entity) = @_;

    # If you want quarantine reports, uncomment next line
    # send_quarantine_notifications();

    # IMPORTANT NOTE:  YOU MUST CALL send_quarantine_notifications()
AFTER
    # ANY PARTS HAVE BEEN QUARANTINED.  SO IF YOU MODIFY THIS FILTER TO
    # QUARANTINE SPAM, REWORK THE LOGIC TO CALL
send_quarantine_notifications()
    # AT THE END!!!

    # No sense doing any extra work
    return if message_rejected();

if ($Features{"SpamAssassin"}) {
        if (-s "./INPUTMSG" < 100*1024) {
            # Only scan messages smaller than 100kB.  Larger messages
            # are extremely unlikely to be spam, and SpamAssassin is
            # dreadfully slow on very large messages.
            my $discardlimit = 9;
            my($hits, $req, $names, $report) = spam_assassin_check();
            if ($hits >= $discardlimit) {
                md_log('spam', $hits, $RelayAddr);
		    my($score);
                return action_discard();
            } else {
            if ($hits >= 7) {
                md_log('spam', $hits, $RelayAddr);
                my($score);
                action_quarantine_entire_message("$report\n");
                send_quarantine_notifications();
                return action_discard();
                if ($hits < 40) {
                    $score = "*" x int($hits);
                } else {
                    $score = "*" x 40;
                }

                # We add a header which looks like this:
                # X-Spam-Score: 6.8 (******) NAME_OF_TEST,NAME_OF_TEST
                # The number of asterisks in parens is the integer part
                # of the spam score clamped to a maximum of 40.
                # MUA filters can easily be written to trigger on a
                # minimum number of asterisks...
                action_change_header("X-Spam-Score", "$hits ($score)
$names");

                # If you find the SA report useful, add it, I guess...
                action_add_part($entity, "text/plain", "-suggest",
                                "$report\n",
                                "SpamAssassinReport.txt", "inline");
            } else {
                # Delete any existing X-Spam-Score header?
                #action_delete_header("X-Spam-Score");
            }
        }
    }
}
    # I HATE HTML MAIL!  If there's a multipart/alternative with both
    # text/plain and text/html parts, nuke the text/html.  Thanks for
    # wasting our disk space and bandwidth...

    # If you don't mind HTML mail, comment out the next line.
    remove_redundant_html_parts($entity);
}

# DO NOT delete the next line, or Perl will complain.
1;
 




More information about the MIMEDefang mailing list