Re: Ok, I'm stumped...

2006-04-06 Thread Matt Kettler
Bowie Bailey wrote: > Matt Kettler wrote: > >> [EMAIL PROTECTED] wrote: >> >>> Philip Prindeville wrote: >>> > header L_INCOMPETENT1ALL =~ /\\r\\n/ > > header L_INCOMPETENT2ALL =~ /\\r\\n\s?$/ > > header L_INCOMPETENT3ALL =~ /\\

RE: Ok, I'm stumped...

2006-04-06 Thread Bowie Bailey
Matt Kettler wrote: > [EMAIL PROTECTED] wrote: > > Philip Prindeville wrote: > > > > header L_INCOMPETENT1ALL =~ /\\r\\n/ > > > > > > > > header L_INCOMPETENT2ALL =~ /\\r\\n\s?$/ > > > > > > > > header L_INCOMPETENT3ALL =~ /\\r\\n\s?\n/ > > > Ok, I tried #3 and

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Matt Kettler wrote: > >> Philip Prindeville wrote: >> >> >>> Matt Kettler wrote: >>> >>> >>> Philip Prindeville wrote: > Matt Kettler wrote: > > > > >> Perhaps you want somethin

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>Matt Kettler wrote: >> >> >> >>>Philip Prindeville wrote: >>> >>> >>> >>> Matt Kettler wrote: >>> >>> >>> >>> >Perhaps you want something more like: > >header L_INCOMPETENT

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
[EMAIL PROTECTED] wrote: > Philip Prindeville wrote: >>> header L_INCOMPETENT1ALL =~ /\\r\\n/ >>> >>> header L_INCOMPETENT2ALL =~ /\\r\\n\s?$/ >>> >>> header L_INCOMPETENT3ALL =~ /\\r\\n\s?\n/ >> Ok, I tried #3 and it worked, as you said... But leaving the \s? >

RE: Ok, I'm stumped...

2006-04-05 Thread Matthew.van.Eerde
Philip Prindeville wrote: >> header L_INCOMPETENT1ALL =~ /\\r\\n/ >> >> header L_INCOMPETENT2ALL =~ /\\r\\n\s?$/ >> >> header L_INCOMPETENT3ALL =~ /\\r\\n\s?\n/ > > Ok, I tried #3 and it worked, as you said... But leaving the \s? > didn't. > > I'm confused.

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Matt Kettler wrote: > >> Philip Prindeville wrote: >> >> >>> Matt Kettler wrote: >>> >>> >> >> Perhaps you want something more like: header L_INCOMPETENTALL =~ /\\r\\n\s?$/ >> Scratch my last email. $ doesn't work with

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>Matt Kettler wrote: >> >> > > > >>>Perhaps you want something more like: >>> >>>header L_INCOMPETENTALL =~ /\\r\\n\s?$/ >>> >>> > >Scratch my last email. $ doesn't work with ALL. > >I just tested 3 variants: > >header L

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Matt Kettler wrote: >> Perhaps you want something more like: >> >> header L_INCOMPETENTALL =~ /\\r\\n\s?$/ Scratch my last email. $ doesn't work with ALL. I just tested 3 variants: header L_INCOMPETENT1ALL =~ /\\r\\n/ header L_INCOMPETENT2

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Matt Kettler wrote: >> Perhaps you want something more like: >> >> header L_INCOMPETENTALL =~ /\\r\\n\s?$/ >> >> The $ forces end-of-line match, and the \s? allows any single whitespace to >> be >> inserted before the actual EOL. >> >> >> >> > > I know t

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>Theo Van Dinter wrote: >> >> >> >>>The malformed content-type header caused this. The MIME part isn't >>>"text/html", it's "text/htmlcontent-transfer-encoding8bitrn". So the best >>>that can happen is URLs are parsed out of the text. >>>

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Theo Van Dinter wrote: > >> The malformed content-type header caused this. The MIME part isn't >> "text/html", it's "text/htmlcontent-transfer-encoding8bitrn". So the best >> that can happen is URLs are parsed out of the text. >> >> > > Ok, we'll here's a new rule:

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Philip Prindeville wrote: >Theo Van Dinter wrote: > > > >>The malformed content-type header caused this. The MIME part isn't >>"text/html", it's "text/htmlcontent-transfer-encoding8bitrn". So the best >>that can happen is URLs are parsed out of the text. >> >> >> >> > >Ok, we'll here's a

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Theo Van Dinter wrote: >The malformed content-type header caused this. The MIME part isn't >"text/html", it's "text/htmlcontent-transfer-encoding8bitrn". So the best >that can happen is URLs are parsed out of the text. > > Ok, we'll here's a new rule: # incompetent spamware programmers... he

Re: Ok, I'm stumped...

2006-04-05 Thread Kelson
Philip Prindeville wrote: Doesn't RFC-822 require that the addresses be bracketed? Or is that only when a comment string is present? Only when there's a comment. -- Kelson Vibber SpeedGate Communications

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Theo Van Dinter wrote: > >>> Well, for a start, normally the X-Spam-* stuff gets inserted at the very >>> >>> end of the header block, but what I'm seeing instead is: >>> >>> >> You're running 3.1 which puts them at the top of the headers. It was in the >> 3.1.0 re

Re: Ok, I'm stumped...

2006-04-05 Thread Kelson
Philip Prindeville wrote: things would be a little clearer if there was a consistent place that the X-Spam-*: stuff got inserted at... It seems to move around. IIRC this is the first time it's moved in the lifetime of the product, but perhaps I've forgotten another occasion... -- Kelson Vib

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Theo Van Dinter wrote: >> Well, for a start, normally the X-Spam-* stuff gets inserted at the very >> >>end of the header block, but what I'm seeing instead is: >> >> > >You're running 3.1 which puts them at the top of the headers. It was in the >3.1.0 release announcement: > >- modify header

Re: Ok, I'm stumped...

2006-04-05 Thread Theo Van Dinter
On Wed, Apr 05, 2006 at 01:46:08PM -0600, Philip Prindeville wrote: > >What gives you that idea? The debug output clearly shows the received > >headers > >being parsed, the mime parser finds the message part (malformed content-type > >and all), URIs are parsed out of the message, etc. > > Well,

Re: Ok, I'm stumped...

2006-04-05 Thread Daryl C. W. O'Shea
Matt Kettler wrote: Philip Prindeville wrote: What gives you that idea? The debug output clearly shows the received headers being parsed, the mime parser finds the message part (malformed content-type and all), URIs are parsed out of the message, etc. Well, for a start, normally the X-Spam-

RE: Ok, I'm stumped...

2006-04-05 Thread Matthew.van.Eerde
Matt Kettler wrote: > Erm.. When do you see SA inserting X-Spam-* at the END of the header > block??? SA doesn't (anymore.) MIMEDefang does, when using action_add_header, which calls libmilter's smfi_addheader function. Recent versions of MIMEDefang have action_insert_header, which can be use

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > >>> >> What gives you that idea? The debug output clearly shows the received >> headers >> being parsed, the mime parser finds the message part (malformed content-type >> and all), URIs are parsed out of the message, etc. >> >> > > Well, for a start, normally the X

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > The following message got through and I couldn't figure out why: > > ftp://ftp.redfish-solutions.com/pub/paypal4.eml > > so I ran: > > spamassassing -x -LD > > on it and saved the output into: > > ftp://ftp.redfish-solutions.com/pub/paypal4.log > > what's odd is th

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Theo Van Dinter wrote: >On Wed, Apr 05, 2006 at 01:30:20PM -0600, Philip Prindeville wrote: > > >>The following message got through and I couldn't figure out why: >> >>ftp://ftp.redfish-solutions.com/pub/paypal4.eml >> >> > >The first problem is that the headers are a bit malformed: > >MIME-

Re: Ok, I'm stumped...

2006-04-05 Thread Theo Van Dinter
On Wed, Apr 05, 2006 at 01:30:20PM -0600, Philip Prindeville wrote: > The following message got through and I couldn't figure out why: > > ftp://ftp.redfish-solutions.com/pub/paypal4.eml The first problem is that the headers are a bit malformed: MIME-Version: 1.0 Content-Type: text/html\r\n Con

Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
The following message got through and I couldn't figure out why: ftp://ftp.redfish-solutions.com/pub/paypal4.eml so I ran: spamassassing -x -LD on it and saved the output into: ftp://ftp.redfish-solutions.com/pub/paypal4.log what's odd is that it reads the first line (the Return-Path:) line a