[exim] SMTP-time spam filtering with crm114 (best approach?)

Hi folks,

I've just spent a day trying to jam exim4 and crm114 together in order
to achieve SMTP-DATA time crm114 checking and spam rejection.

What I want to do is run a program in the (post) DATA ACL, passing the
headers and body of the message to the program, and then have the
program instruct exim (via some method) whether or not to reject the
message (or take another action e.g. greylisting). I also want to add
headers to the message if the message is accepted.

It would appear that the spamassassin/spamd 'spam' exiscan would not
permit adding headers to a message. Is that true? (There's a minimal
spamd implementation "crm114-spamd" which can be used in conjunction
with exim this way)

The AV stuff seems more flexible than the spam stuff. I managed a
proof-of-concept by abusing the 'cmdline' av_scanner option. However,
this would not let me add headers to accepted mail either.

There's the option of local_scan, and there's sa-exim which plugs
spamassassin into exim that way. And I can theoretically plug crm114
into SA (and turn off SA's other tests). This does appear to be able to
add headers to the message. Is this the only way to achieve what I want?

I'm also curious if anyone has thoughts on the best approach for
integrating 3rd-party scanning software into MTAs. Each MTA does things
differently, it would appear. IMHO (from what little I've seen)
postfix's attitude of talking SMTP or LMTP to a local socket is the
cleanest approach (but of course I don't have a suitable SMTP or LTMP
daemon front-ending crm114 either)

Many thanks,

- --
Jon Dowland