Hello Sylvain,
Thursday, January 22, 2004, 7:39:22 AM, you wrote:
RM>> Results against my corpus:
RM>> SYL_BAD_XOIP -- 73662s/14971h of 91714 corpus (74113s/17601h) 01/21/04
SR> Yes, that's pretty consistent with what I realized it was doing ... :-(
SR> I can't even begin to thank you enough for having taken the time to test
SR> that ...
RM>> I suspect the problem is that since you're saying X-Originating-IP must
RM>> NOT be the regex, emails with no X-Originating-IP are also matching.
SR> That seems plausible ...
RM>> Add a test for UNSET (no such tag), and you should be able to improve
RM>> these results.
SR> Let me see if I understand your suggestion correctly (Sorry about the
SR> long line) ...
SR> header SYL_BAD_XOIP X-Originating-IP !~
SR> /\[?(\d{1,3}\.){3}\d{1,3}\]?/ [if-unset: 0.0.0.0]
SR> describe SYL_BAD_XOIP Improperly formatted X-Originating-IP header
SR> score SYL_BAD_XOIP 4.0 # frankly, this alone should be grounds
SR> # for rejection ...
header SYL_BAD_XOIPa X-Originating-IP !~ /\[?(\d{1,3}\.){3}\d{1,3}\]?/ [if-unset:
0.0.0.0]
describe SYL_BAD_XOIPa Improperly formatted X-Originating-IP header
score SYL_BAD_XOIPa 4.0 # frankly, this alone should be grounds
# for rejection ...
Yes, that one works for me:
SYL_BAD_XOIPa -- 3881s/0h of 91714 corpus (74113s/17601h) 01/22/04
With results like this, 5% of the spam in my corpus and no ham, this is a
rule that should be added to the next distribution set (or at least a
variation thereof). Would you have any objection to submitting for
consideration, and sending in an Apache Contributor License Agreement so
the SA developers can use this rule?
Thanks.
Bob Menschel
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
