[Exim] Lookup-depended subject tagging.

Greetings,

I've came across a problem here and I was wondering if anyone got a
creative solution for this one.
I am using exim v4 + exiscan patch: spamassassin + clamd and I wish
to tag the subject when it acrosses a malware only at a certain
condition (mysql lookup to check user's configuration).
If the return of the mysql lookup is 0, then no operation at all.
10 means to tag the subject and 20 means to completely ditch it.

  My problem comes with the tagging:
  I'm setting the new subject right at the exiscan rules:
  warn  message = X-Malware-Alert: This message contains malware ($malware_name)
        malware = *
        log_message = This message contains malware ($malware_name)
  warn  message = X-New-Subject-Malware: **MALWARE** $h_subject:
        malware = *

  and I've tried to use a system filter:
  if "${if def:header_X-New-Subject-Malware: {there}}" is there
  then
     headers remove subject
     headers add "Subject: $h_X-New-Subject-Malware:"
     headers remove X-New-Subject-Malware
  endif

  The problem is, it will always change the subject that way,
  regardless the mysql values.  I noticed I can't:
  - Do header changing when using a specific filter inside a router
  - Call headers_remove or headers_add twice inside a router.
  - Couldn't set temproary variables ("macros") like I can in the main
    configuration.

Also I've tried to do this one which didn't work very well neither:

process_filter_one:
    driver = redirect
    allow_fail
    headers_remove = Subject
    headers_add = Subject: **MALWARE** $h_X-New-Subject-Malware\n
    data = $local_part@$domain

process_filter_two:
    driver = redirect
    allow_fail
    headers_remove = X-New-Subject-Malware
    data = $local_part@$domain

My question is: How can I tag the subject while doing it under a
condition of a mysql check?


Thank you, Tomer.

----------------------------------
   Tomer H.    tomer@???
       IT Solutions Provider
www.metnix.com     info@???
----------------------------------