You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Rob Arista <ar...@gmail.com> on 2011/04/16 19:05:00 UTC
How to set right priorities when mixing Multi-scoring ClamAV &
Shortcircuit plugins?
In the clamav.cf plugin file the CLAMAV rule is set at default
priority=0, with a score of 0.001
Its other rules are supposed to get really high prioritites,
priority __CLAMAV_PHISH 9999
priority __CLAMAV_PHISH_HEUR 9999
priority __CLAMAV_SANE 9999
priority __CLAMAV_MBL 9999
priority __CLAMAV_MSRBL 9999
priority __CLAMAV_VX 9999
the main rule CLAMAV_VIRUS is defined as a meta rule,
meta CLAMAV_VIRUS (CLAMAV && !__CLAMAV_PHISH && !__CLAMAV_SANE &&
!__CLAMAV_MBL && !__CLAMAV_MSRBL && !__CLAMAV_VX)
so to execute is has to wait until all those late priority=9999 rules
are triggered.
Shortcircuit rules are supposed to get low priorities to fire early
ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
# ClamAV support: no need to scan viruses/malware
priority CLAMAV -9999
shortcircuit CLAMAV spam
score CLAMAV 100
endif # Mail::SpamAssassin::Plugin::Shortcircuit
I want to use the shortcircuit rule to stop processing early and
immediately reject (e.g., at score >=20) only if CLAMAV_VIRUS or
CLAMAV_SANE hit. for any of the other rules, I want to keep
processing, and just add scores.
So in Shortcircuit I'd need to use something lile,
meta SC_MULTI_CLAMAV (CLAMAV_VIRUS||CLAMAV_SANE)
priority SC_HAM -2000
But, how do I fix the conflict of needing the rules EARLY for
shortcircuit, but at the same time needing them LATE for the CLAMAV
plugin?
--Bob