Use X-Amavis-Alert header to influence Spam Assassin Scoring

[Josh Hamell]

Hi,

http://lists.amavis.org/pipermail/amavis-users/2014-September/003143.html

Basic request:
* For banned attachments, we strip attachments + PASS (and rewrite
header/inject disclaimer)
* Vast, vast majority of this is unsolicited email
* I would like Spam Assassin to be able to elevate scoring for these
messages.

My idea was to use an SA rule such as:
X-Amavis-Alert =~ /^BANNED, message contains.*\.js$/

But it's not being applied. I suspect that may be due to:
* Non deterministic order of amavis checks
* Amavis headers are injected in immediately before delivery, and
therefore aren't available for SA to analyze.
* My lack of experience w/ crafting SA rules

Thank you,
Josh Hamell

[@lbutlr]

Post by Josh Hamell
Amavis headers are injected in immediately before delivery, and
therefore aren't available for SA to analyze.

This is my understanding, amavis headers aren't there until after SA

[Josh Hamell]

Post by @lbutlr

Post by Josh Hamell
Amavis headers are injected in immediately before delivery, and
therefore aren't available for SA to analyze.

This is my understanding, amavis headers aren't there until after SA

Thank you - SA is batting about 92% detection rate for the resulting
BANNED messages. If it does become an issue, I will need to configure
SA to look at attachments (duplicating the work of AMAVIS), but this may
be enough for now.

-Josh

[C.J. Collier]

I think that re-factoring amavis into smaller chunks so that spamassassin
can «use» those modules will reduce the duplicated code, if not the
duplicated effort.

What is the benefit of having all of the 71 packages in the same file?
This will make it difficult to write and exercise unit tests. If it's the
concern of handling 71 different file handles, the build system could
concatenate all of the individual files to a single monolithic script for
distribution.

Can you tell I've been thinking about this the last 24 hours? :-)

Cheers,

C.J.

Post by Josh Hamell

Post by @lbutlr

Post by Josh Hamell
Amavis headers are injected in immediately before delivery, and
therefore aren't available for SA to analyze.

This is my understanding, amavis headers aren't there until after SA

Thank you - SA is batting about 92% detection rate for the resulting
BANNED messages. If it does become an issue, I will need to configure
SA to look at attachments (duplicating the work of AMAVIS), but this may
be enough for now.
-Josh