Reformatting spam score in subject?

Jeff Morris jeffm859 at nullmodem.org
Wed Mar 29 08:24:24 CEST 2017


I posted about this last year but wasn't able to find a solution, so I'm 
revisiting it.

I have amavis configured to add the spam score to the subject line of 
spammy messages via the following variable in amavisd.conf:

   $sa_spam_subject_tag = '[SPAM: _SCORE_] ';

This gives me subject lines like the following examples:

   Subject: [SPAM: 21.21] Spammy Subject
   Subject: [SPAM: 7.13] Another Spammy Subject

I would like the scores to be zero-padded, so I can easily sort the spam 
in my email client (Thunderbird) by subject, so I can look for 
false-positives with lowish scores. For example, I would like the above 
examples to be changed to this:

   Subject: [SPAM: 007.13] Another Spammy Subject
Subject: [SPAM: 021.21] Spammy Subject

When I posted here last year someone suggested changing "_SCORE_" in my 
amavisd.conf to "_SCORE(000)_", however this does not work. It does not 
get parsed, instead it gives me the literal "_SCORE(000)_" in my subject 
lines, like this:

   Subject: [_SCORE(000)_] Spammy Subject
   Subject: [_SCORE(000)_] Another Spammy Subject

I've spent quite a bit of time trying to figure this out and have made 
no progress.

Could someone explain to me, in layman's terms, what amavisd does with 
the contents of the $sa_spam_subject_tag variable? Does it pass this to 
Spamassassin (in which case the problem I'm having would be with 
Spamassasin, rather than Amavis), or does Amavis parse this and replace 
it? I really don't understand the flow here through Amavis. I've done a 
fair amount of Perl scripting in my time, but I don't recognize the 
underscores as a Perl construct, and strings in single-quotes aren't 
parsed by Perl, so I really don't understand where the contents of this 
variable are getting parsed? I've been looking at /usr/sbin/amavisd, and 
it looks like _SCORE_ is some sort of amavisd macro. For example, on 
line 12304 I see this:

   SCORE  => sub {macro_score($MSGINFO,undef, at _)}

And on line 11849 I see the definition for the above macro_score 
function, which looks like is should parse "_SCORE(000)_", but as I said 
above, it doesn't when it's used in $sa_spam_subject_tag. I also see on 
line 16373 code to parse the contents of $subject_tag (not 
$sa_spam_subject_tag). This code does NOT appear to be capable of 
parsing the "_SCORE(000)_" syntax, so I tried changing the sprintf 
format on line 16377 from "%.3f" to "%07.3f", but this had no effect, so 
apparently $subject_tag and $sa_spam_subject_tag are not equivalent.

This is getting really frustrating, as it seems like such a simple 
change, but I've spent many hours trying different configuration options 
and digging through amavis' source code off and on over the past year 
trying to understand it, but still don't feel like I've made any 
progress. I'd really appreciate any help anyone could give.

I'm running CentOS 7.3.1611, amavisd-new-2.10.1-5, and spamassassin-3.4.0-2.

Thanks!



More information about the amavis-users mailing list