spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Karsten Br├Ąckelmann <guent...@rudersport.de>
Subject Re: SA 3.3.1 bug or mistake in my custom rules?
Date Thu, 13 Oct 2011 04:15:36 GMT
On Wed, 2011-10-12 at 23:32 -0230, Lawrence @ Rogers wrote:
> Starting today, I've noticed that 3 of my rules fire in situations where 
> they should not. They are simple meta rules that count how many rule, 
> against certain URIBL rules, fire. They then raise the spam score.

> meta LW_URIBL_LO ((URIBL_BLACK + URIBL_RED + URIBL_SBL + URIBL_AB_SURBL 
> + URIBL_JP_SURBL + URIBL_OB_SURBL + URIBL_PH_SURBL + URIBL_SC_SURBL + 
> URIBL_WS_SURBL) == 1)

URIBL_RHS_DOB is missing here.

> meta LW_URIBL_MD ((URIBL_BLACK + URIBL_RED + URIBL_SBL + URIBL_AB_SURBL 
> + URIBL_JP_SURBL + URIBL_OB_SURBL + URIBL_PH_SURBL + URIBL_SC_SURBL + 
> URIBL_WS_SURBL + URIBL_RHS_DOB) == 2)
> 
> meta LW_URIBL_HI [...]

> I'm receiving e-mails where both LW_URIBL_LO and LW_URIBL_MD are fired. 

That would happen, if URIBL_RHS_DOB and another rule of the LO meta
variant are hit.

> The only rule in the message that could trigger them are URIBL_DBL_SPAM 
> and URIBL_RHS_DOB

DBL is not part of the meta, so I don't get this. Or did you actually
mean to communicate, these are the only URI DNSBL rules triggered? That
would be even more confusing -- a real Status header copied would have
helped...

The above rules are *verbatim*, copy and paste from your rc files, with
no human messing around, right?


In a related note, as per the M::SA::Conf docs for meta rules -- "The
value of a hit meta test is that of its arithmetic expression. The value
of a hit eval test is that returned by its method."

The latter means, this style of adding "rules" is not necessarily safe,
since these are eval tests. However, in this case, I believe they all
should be set to 1 in case of a match.

The former means, you could eliminate such issues due to inconsistencies
and code duplication, by using an additional meta level:

  meta __VALUE  FOO + BAR

  meta ONE  __VALUE == 1
  meta TWO  __VALUE == 2


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0;
}}}


Mime
View raw message