Plugin API

Handy functions in the fuglu.shared module


Return the human readable string for this code

fuglu.shared.string_to_actioncode(actionstring, config=None)

return the code for this action

fuglu.shared.apply_template(templatecontent, suspect, values=None, valuesfunction=None)

Replace templatecontent variables as defined in with actual values from suspect the calling function can pass additional values by passing a values dict

if valuesfunction is not none, it is called with the final dict with all built-in and passed values and allows further modifications, like SQL escaping etc

fuglu.shared.default_template_values(suspect, values=None)

Return a dict with default template variables applicable for this suspect if values is not none, fill the values dict instead of returning a new one

The Suspect class

class fuglu.shared.Suspect(from_address, recipients, tempfile, att_cachelimit=None, smtp_options=set([]), sasl_login=None, sasl_sender=None, sasl_method=None, queue_id=None)

The suspect represents the message to be scanned. Each scannerplugin will be presented with a suspect and may modify the tags or even the message content itself.

add_header(key, value, immediate=False)

adds a header to the message. by default, headers will added when re-injecting the message back to postfix if you set immediate=True the message source will be replaced immediately. Only set this to true if a header must be visible to later plugins (eg. for spamassassin rules), otherwise, leave as False which is faster.

added_headers = None

To keep track of already added headers (not in self.addheaders)

client_info_from_rcvd(ignoreregex=None, skip=0)

returns information about the client that submitted this message. (helo,ip,reversedns)

This information is extracted from the message Received: headers and therefore probably not 100% reliable all information is returned as-is, this means for example, that non-fcrdns client will show ‘unknown’ as reverse dns value.

if ignoreregex is not None, all results which match this regex in either helo,ip or reversedns will be ignored

By default, this method starts searching at the top Received Header. Set a higher skip value to start searching further down.

both these arguments can be used to filter received headers from local systems in order to get the information from a boundary MTA

returns None if the client info can not be found or if all applicable values are filtered by skip/ignoreregex

clientinfo = None

holds client info tuple: helo, ip, reversedns


Add a line to the debug log if debugging is enabled for this message

static decode_msg_header(header, decode_errors='replace')

Decode message header from email.message into unicode string

header (str, email.header.Header): the header to decode decode_errors (str): error handling as in standard bytes.decode -> strict, ignore, replace

returns information about the client that submitted this message. (helo,ip,reversedns)

In before-queue mode this info is extracted using the XFORWARD SMTP protocol extension.

In after-queue mode this information is extracted from the message Received: headers and therefore probably not 100% reliable all information is returned as-is, this means for example, that non-fcrdns client will show ‘unknown’ as reverse dns value.

if no config object is passed, the first parseable Received header is used. otherwise, the config is used to determine the correct boundary MTA (trustedhostsregex / boundarydistance)


Returns the message headers as string

(unicode str) unicode for Py2, str for Py3

returns the python email api representation of this suspect


returns the original, unmodified message source


returns the current message source, possibly changed by plugins

get_tag(key, defaultvalue=None)

returns the tag value. if the tag is not found, return defaultvalue instead (None if no defaultvalue passed)


Returns True if ANY plugin tagged this suspect as blocked


Returns True if message is neither considered to be spam, virus or blocked


Returns True if ANY of the spam engines tagged this suspect as high spam


returns true if the message source has been modified


Returns True if ANY of the spam engines tagged this suspect as spam


Returns True if ANY of the antivirus engines tagged this suspect as infected

modified_headers = None

To keep track of modified headers

parse_from_type_header(header='From', validate_mail=True, recombine=True)
header (str): name of header to extract, defaults to From validate_mail (bool): base checks for valid mail recombine (bool): recombine displaypart with mailaddress
[(displayname,email), … ]
  • displayname (str) : display name
  • email (str) : email address
static prepend_header_to_source(key, value, source)

Prepend a header to the message

key (str): the header key value (str): the header value source (bytes): the message source
bytes: the new message buffer
set_header(key, value)

Replace existing header or create a new one

key (string): header key value (string): header value
set_message_rep(msgrep, att_mgr_reset=True)

replace the message content. this must be a standard python email representation Warning: setting the source via python email representation seems to break dkim signatures!

The attachment manager is build based on the python mail representation. If no message attachments or content is modified there is no need to recreate the attachment manager.

msgrep (email): standard python email representation
Keyword Args:
att_mgr_reset (bool): Reset the attachment manager
set_source(source, encoding='utf-8', att_mgr_reset=True)

Store message source. This might be modified by plugins later on…

source (bytes,str,unicode): new message source
Keyword Args:
encoding (str): encoding, default is utf-8 att_mgr_reset (bool): Reset the attachment manager
set_tag(key, value)

Set a new tag

source = None

holds the message source if set directly

source_stripped_attachments(content=None, maxsize=None)

strip all attachments from multipart mails except for plaintext and html text parts. if message is still too long, truncate.

content (string,bytes): message source maxsize (integer): maximum message size accepted
bytes: stripped and truncated message content

Returns the first recipient address


Returns the local part of the first recipient


Returns the local part of the first recipient

update_subject(subject_cb, **cb_params)

update/alter the message subject :param subject_cb: callback function that alters the subject. must accept a string and return a string :param cb_params: additional parameters to be passed to subject_cb :return: True if subject was altered, False otherwise

The SuspectFilter class

class fuglu.shared.SuspectFilter(filename)

Allows filtering Suspect based on header/tag/body regexes


Return True if the file has changed on disks since the last reload

get_args(suspect, extended=False)

returns all args of matched regexes in a list if extended=True: returns a list of tuples with all available information: (fieldname, matchedvalue, arg, regex)

get_decoded_textparts(suspect, attachment=None, inline=None)

Get all text parts of suspect as a list. Text parts can be limited by the attachment, inline keywords which checks the Content-Disposition header:

attachment: True/False/None
None: Ignore True: attachment or header not present False: no attachment
inline: True/False/None
None: Ignore True: inline attachment False: no inline attachment or header present, so attached textparts are included
suspect (Suspect): Suspect object attachment (bool, NoneType): filter for attachments inline (bool, NoneType): filter for inline attachments

The input should be a Suspect. Due to backward compatibility email.message.Message is still supported and passed to the deprecated routine which will however NOT handle the additional keyword parameters for filtering attachments and inline attachments.

list: List containing decoded text parts

Returns a list of all text contents

get_field(suspect, headername)

return a list of mail header values or special values. If the value can not be found, an empty list is returned.

just the headername or header:<headername> for standard message headers mime:headername for attached mime part headers
envelope data:
envelope_from (or from_address) envelope_to (or to_address) from_domain to_domain clientip clienthostname (fcrdns or ‘unknown’) clienthelo
body source:
body:full -> (full source, encoded) body:stripped (or just ‘body’) : -> returns text/* bodyparts with tags and newlines stripped body:raw -> decoded raw message body parts

check file and print warnings to console. returns True if everything is ok, False otherwise

matches(suspect, extended=False)

returns (True,arg) if any regex matches, (False,None) otherwise

if extended=True, returns all available info about the match in a tuple: True, (fieldname, matchedvalue, arg, regex)

strip_text(content, remove_tags=None, replace_nbsp=True, use_bfs=True)

Strip HTML Tags from content, replace newline with space (like Spamassassin)

(unicode/str) Unicode string (Py3 ‘str’ is unicode string)