On Wed, 21 Jan 2004, Robert Menschel wrote:
> Results against my corpus:
> SYL_BAD_XOIP -- 73662s/14971h of 91714 corpus (74113s/17601h) 01/21/04
Yes, that's pretty consistent with what I realized it was doing ... :-(
I can't even begin to thank you enough for having taken the time to test
that ...
> I suspect the problem is that since you're saying X-Originating-IP must
> NOT be the regex, emails with no X-Originating-IP are also matching.
That seems plausible ...
> Add a test for UNSET (no such tag), and you should be able to improve
> these results.
Let me see if I understand your suggestion correctly (Sorry about the
long line) ...
header SYL_BAD_XOIP X-Originating-IP !~ /\[?(\d{1,3}\.){3}\d{1,3}\]?/ [if-unset:
0.0.0.0]
describe SYL_BAD_XOIP Improperly formatted X-Originating-IP header
score SYL_BAD_XOIP 4.0 # frankly, this alone should be grounds
# for rejection ...
> That's almost 15k ham matched, out of 17.6k ham in my corpus.
I don't suppose I could lean on you to try the above?
Thanks for the followup, I really appreciate it ...
--
----------------------------------------------------------------------
Sylvain Robitaille [EMAIL PROTECTED]
Systems analyst Concordia University
Instructional & Information Technology Montreal, Quebec, Canada
----------------------------------------------------------------------
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
