On Sat, 9 Apr 2011, David Touzeau wrote:
Le samedi 09 avril 2011 à 08:59 -0700, John Hardin a écrit :
On Sat, 9 Apr 2011, Benny Pedersen wrote:
This to manage a quarantine area.
Rejecting the message cause troubles according VIPs that needs to
receive some attached files.
So i would like to know if there is way or someone trying to set
Spamassassin to increase score against message size.
Including or excluding headers? Including or excluding attachments?
Bear in mind that spamc enforces a maximum message size limit, spamd won't
even _see_ messages larger than that size. Are you going to crank that
size limit up?
Do you really want to spend the resources scanning messages larger than
that limit?
It's possible your MTA inserts a Content-Length: header before SA sees the
message. If so, then checking it is fairly trivial. Try to determine
whether your MTA does this.
If not, SA does not currently (that I can find) expose the raw size of the
message to rules. Having it generate an X-Content-Length: pseudoheader
probably wouldn't be too difficult.
For now, trivially, you can do something like this:
header __HDR_BYTES ALL =~ /./
tflags __HDR_BYTES multiple
rawbody __BODY_BYTES /./
tflags __BODY_BYTES multiple
meta SZ_GT_200K (__HDR_BYTES + __BODY_BYTES) > 200000
...but that will probably do Bad Things to your performance.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
People seem to have this obsession with objects and tools as being
dangerous in and of themselves, as though a weapon will act of its
own accord to cause harm. A weapon is just a force multiplier. It's
*humans* that are (or are not) dangerous.
-----------------------------------------------------------------------
4 days until Thomas Jefferson's 268th Birthday
