You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Rob Arista <ar...@gmail.com> on 2011/04/16 19:05:00 UTC

How to set right priorities when mixing Multi-scoring ClamAV & Shortcircuit plugins?

In the clamav.cf plugin file the CLAMAV rule is set at default
priority=0, with a score of 0.001

Its other rules are supposed to get really high prioritites,

priority __CLAMAV_PHISH      9999
priority __CLAMAV_PHISH_HEUR 9999
priority __CLAMAV_SANE       9999
priority __CLAMAV_MBL        9999
priority __CLAMAV_MSRBL      9999
priority __CLAMAV_VX         9999

the main rule CLAMAV_VIRUS is defined as a meta rule,

meta CLAMAV_VIRUS (CLAMAV && !__CLAMAV_PHISH && !__CLAMAV_SANE &&
!__CLAMAV_MBL && !__CLAMAV_MSRBL && !__CLAMAV_VX)

so to execute is has to wait until all those late priority=9999 rules
are triggered.

Shortcircuit rules are supposed to get low priorities to fire early

ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
# ClamAV support: no need to scan viruses/malware
 priority CLAMAV -9999
 shortcircuit CLAMAV spam
 score CLAMAV 100
endif # Mail::SpamAssassin::Plugin::Shortcircuit

I want to use the shortcircuit rule to stop processing early and
immediately reject (e.g., at score >=20) only if CLAMAV_VIRUS or
CLAMAV_SANE hit.  for any of the other rules, I want to keep
processing, and just add scores.

So in Shortcircuit I'd need to use something lile,

 meta SC_MULTI_CLAMAV (CLAMAV_VIRUS||CLAMAV_SANE)
 priority SC_HAM                 -2000

But, how do I fix the conflict of needing the rules EARLY for
shortcircuit, but at the same time needing them LATE for the CLAMAV
plugin?

--Bob