[Mimedefang] MD/SA and Outlook

Gary Funck gary at intrepid.com
Thu Jan 20 12:23:08 EST 2005



> -----Original Message-----
> From: mimedefang-bounces at lists.roaringpenguin.com
> [mailto:mimedefang-bounces at lists.roaringpenguin.com]On Behalf Of Todd
> Aiken
> Sent: Thursday, January 20, 2005 7:58 AM
> To: mimedefang at lists.roaringpenguin.com
> Subject: Re: [Mimedefang] MD/SA and Outlook
>
>
> On 20 Jan 2005 at 10:50, David F. Skoll wrote:
>
> > On Thu, 20 Jan 2005, Todd Aiken wrote:
> >
> > > Absolutely true, and the line:
> >
> > >                 action_change_header('X-Spam-Report', $fixed_report);
> >
> > > in the filter_end section of my mimedefang-filter does that.
> >
> > Ah.  So you did modify the example filter. :-)
>
> Oh, I thought that was part of the default example file!  I must have
> pulled it from another example file, as I don't remember adding it
> myself.

Did you really want to put the full report into the headers, and not
something
a bit more abbreviated such as the more/less original rendition?

  action_change_header("X-Spam-Score", "$hits ($score) $names");

The code that KAM/JKC contributed, is what we use:

    # Spam checks if SpamAssassin is installed
    if ($Features{"SpamAssassin"}) {
        if (-s "./INPUTMSG" < 100*1024) {
            # Only scan messages smaller than 100kB.  Larger messages
            # are extremely unlikely to be spam, and SpamAssassin is
            # dreadfully slow on very large messages.
            my($hits, $req, $names, $report) = spam_assassin_check();
            my($score);
            if ($hits < 40) {
                $score = "*" x int($hits);
            } else {
                $score = "*" x 40;
            }
            # We add a header which looks like this:
            # X-Spam-Score: 6.8 (******) NAME_OF_TEST,NAME_OF_TEST
            # The number of asterisks in parens is the integer part
            # of the spam score clamped to a maximum of 40.
            # MUA filters can easily be written to trigger on a
            # minimum number of asterisks...
            if ($hits >= $req) {
                action_change_header("X-Spam-Score", "$hits ($score)
$names");
                md_graphdefang_log('spam', $hits, $RelayAddr);

                # BEGIN REPORTSAFE - KAM 10-29-2003
                # Implement Report_Safe -- Thanks to James W. Curtis for the
original starting code!
                my ($container, $parser, $original, $report2);

                $container = MIME::Entity->build(Type => 'message/rfc822',
                Description => 'Original message before MIMEDefang',
                Disposition => 'Attachment',
                Data => [ "" ]);
                $parser = new MIME::Parser;
                open(IN, '< INPUTMSG');
                $original = $parser->parse(\*IN);
                close(IN);

                $original->head()->replace('X-Relay-Addr', $RelayAddr);
                $RelayHostname ||= 'N/A';
                $original->head()->replace('X-Relay-Host', $RelayHostname);
                $original->head()->replace('X-Relay-Time',
scalar(localtime));

                # Add the original message to the container
                $container->add_part($original);

                $report2 = MIME::Entity->build(Type => 'text/plain',
                               Description => 'SpamAssassin Warning',
                               Data  => ["$report\n"],
                               Disposition => "inline",
                               Encoding => "-suggest");
                $entity->parts([$report2]);
                $entity->head()->mime_attr('content-type' =>
'multipart/mixed');
                $entity->head()->mime_attr('content-type.boundary' =>
'------------=_' . scalar(time) .  "-$$-nikc");
                $entity->add_part($container);
                action_rebuild();
                # END REPORTSAFE
            } else {
                # pass the hits through on non-spam as well
                action_change_header("X-Spam-Score", "$hits ($score)
$names");
            }
        }
    }

Note that we add the "report safe" attachment if it is determined that the
mail is spam, and we add the spam score, along with the $names of the rules
that hit, even it is determined not to be spam.





More information about the MIMEDefang mailing list