procmail
[Top] [All Lists]

Re: More clamav testing (results)

2004-02-14 09:32:14
On 14 Feb 2004, at 05:30, Dallman Ross wrote:
On Fri, Feb 13, 2004 at 05:24:37PM -0800, Bart Schaefer wrote:
On Sat, 14 Feb 2004, Dallman Ross wrote:

As far as I've been able to determine the ONLY way to discover that
spamc failed to connect to spamd is to allow it to (attempt to)
rewrite the message header, and then look at the header to see whether
the X-Spam- lines have been added (if they weren't, no spamd).

I don't think I agree entirely.  First of all, I don't ever allow spamc
to touch my headers.  I don't want it writing to them; and I don't want
them changed by it.  (For example, spamc *changes* tabs to spaces and
changes the whitespace quantum and wrapping in headers.  I don't like
that at all.)  So I use the -c option and merely collect the score in a
variable.  Recipes below that decide what to do with the score.

I don't think any of this is true anymore. SA's default action is to leave the original message completely untouched and simply encapsulate it as a message attachment with new headers. This preserves the original message in case it is a false positive (which, in my use of SA 2.6x occurs less than 0.1% of the time)

   :0 W
   CS_OUT=| clamscan --options -

My point was that I strongly suspect the latter DOES cause the
results to be thrown out.  Unless I missed something (overtrimmed
when excerpting), your recipes never look at the results in any case

I didn't believe this, so I just tested it.  You know what?  You are
absolutely right!

Kudos to Bart for finding this!

Personally, I do use a private compile of procmail that has this and
several other bugs fixed, and that offers some other extended
features, the biggest being left-match capturing.  It's very cleverly
conceived by Mike Peeler.  I do not know if Mike wishes to make
his code public or not.

left Match capturing would be a very nice feature to have. would have saved me quite a lot of time just in the last week.

--
Rid yourself of doubt --
                                or should you?
-George Carlin


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail