You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2006/01/19 17:51:36 UTC
[Bug 4763] New: If the clamav plug in shows a virus...no need to run the other tests
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
Summary: If the clamav plug in shows a virus...no need to run the
other tests
Product: Spamassassin
Version: 3.1.0
Platform: All
OS/Version: All
Status: NEW
Severity: enhancement
Priority: P5
Component: Plugins
AssignedTo: dev@spamassassin.apache.org
ReportedBy: vikram@gurjar.com
Hi,
Just a suggestion that would make SA more in tune with mail server requirements.
If the Clamav plug-in shown on http://wiki.apache.org/spamassassin/ClamAVPlugin
reports a virus then there is really no need to run the other tests.
Is there anyway to put this test first and if the result is positive for a
virus, bypass the other tests?
Regards,
Vikram J. Gurjar
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
jm@jmason.org changed:
What |Removed |Added
----------------------------------------------------------------------------
BugsThisDependsOn| |3109
Status|RESOLVED |REOPENED
Resolution|DUPLICATE |
------- Additional Comments From jm@jmason.org 2006-01-19 18:23 -------
actually I'd prefer not to mark this as a dup, instead just make it depend on
3109. it's a good idea btw.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
------- Additional Comments From vikram@gurjar.com 2006-01-20 12:39 -------
Guys,
After looking at bug 3109, what SA needs to do to be really efficient is to stop
testing once a test determines for sure if it is ham or spam.
>From my point of view it would be as follows :
1. Check for illegal attachments like .scr or .pif If found, mark as spam and
stop testing.
2. Check for virus. If found, mark as spam and stop testing.
3. Check the black lists. If found, mark as spam and stop testing.
4. Check for white lists. If found, mark as ham and stop testing.
So what SA requires is a .cf file called priority.cf or similar (in the same
directory as local.cf) in which these tests are put in the order of priority.
The scores can only be ham or spam. If any of the tests are true, no further
tests will be conducted.
As to bayesian learning, only the ham(if at all) needs to be autolearned. The
first three are pointless.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
------- Additional Comments From jm@jmason.org 2006-01-22 00:39 -------
Vikram: see bug 3109. part of what you describe has already been implemented,
and a good deal else has been thought through, although not yet implemented.
Further discussion of implementation details of shortcircuiting in general,
should take place on that bug.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
------- Additional Comments From jm@jmason.org 2006-01-19 22:32 -------
'I don't really understand the logic here. The request is to provide a way of
doing short-circuiting when certain tests hit (the choice of which tests is
irrelevant), and is the same thing as/a subset of bug 3109.'
no; that bug is a request to develop short-circuiting, this is a request to
apply that short-circuiting for the ClamAVPlugin rule(s).
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
felicity@apache.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |DUPLICATE
------- Additional Comments From felicity@apache.org 2006-01-19 17:54 -------
there is no current way to do what you're asking, but bug 3109 is tracking the request to deal with short
circuiting which would let you do this.
*** This bug has been marked as a duplicate of 3109 ***
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
Bug 4763 depends on bug 3109, which changed state.
Bug 3109 Summary: RFE: really simple "this is ham" shortcircuiting
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=3109
What |Old Value |New Value
----------------------------------------------------------------------------
Status|REOPENED |NEW
Status|NEW |RESOLVED
Resolution| |FIXED
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
vikram@gurjar.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |DUPLICATE
------- Additional Comments From vikram@gurjar.com 2006-01-22 13:37 -------
*** This bug has been marked as a duplicate of 3109 ***
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
------- Additional Comments From felicity@apache.org 2006-01-19 22:49 -------
(In reply to comment #5)
> no; that bug is a request to develop short-circuiting, this is a request to
> apply that short-circuiting for the ClamAVPlugin rule(s).
in that case, since the ClamAVPlugin isn't part of the normal SpamAssassin distribution, we shouldn't be
tracking the request in BZ since there's nothing for us to do.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
------- Additional Comments From felicity@apache.org 2006-01-19 22:00 -------
(In reply to comment #2)
> actually I'd prefer not to mark this as a dup, instead just make it depend on
> 3109. it's a good idea btw.
I don't really understand the logic here. The request is to provide a way of doing short-circuiting when
certain tests hit (the choice of which tests is irrelevant), and is the same thing as/a subset of bug 3109.
Having these two tickets separate doesn't make a lot of sense to me.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4763] If the clamav plug in shows a virus...no need to run the other tests
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4763
------- Additional Comments From vikram@gurjar.com 2006-01-19 20:54 -------
Just felt that running the whole load of network tests (RBLs checks etc) on
something that is known to be a virus is a sheer waste of resources both mine
and others. And viruses comprise of about a quarter to a third of all email
these days.
Just one rule -
full ILLEGAL_ATTACHMENT
/ilename.*.{0,25}(\.hqx|\.mim|\.exe|\.pif|\.vb|\.scr|\.com)/i
describe ILLEGAL_ATTACHMENT Attachment type not allowed
score ILLEGAL_ATTACHMENT 110
Followed by the ClamAV plug in (again scored at 110) eliminates about 30% of the
incoming mail on my server. I see no need to do any further tests (especially
network tests) on emails that test positive here.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.