On Wed, 2011-10-12 at 23:32 -0230, Lawrence @ Rogers wrote:
> Starting today, I've noticed that 3 of my rules fire in situations where
> they should not. They are simple meta rules that count how many rule,
> against certain URIBL rules, fire. They then raise the spam score.
> meta LW_URIBL_LO ((URIBL_BLACK + URIBL_RED + URIBL_SBL + URIBL_AB_SURBL
> + URIBL_JP_SURBL + URIBL_OB_SURBL + URIBL_PH_SURBL + URIBL_SC_SURBL +
> URIBL_WS_SURBL) == 1)
URIBL_RHS_DOB is missing here.
> meta LW_URIBL_MD ((URIBL_BLACK + URIBL_RED + URIBL_SBL + URIBL_AB_SURBL
> + URIBL_JP_SURBL + URIBL_OB_SURBL + URIBL_PH_SURBL + URIBL_SC_SURBL +
> URIBL_WS_SURBL + URIBL_RHS_DOB) == 2)
>
> meta LW_URIBL_HI [...]
> I'm receiving e-mails where both LW_URIBL_LO and LW_URIBL_MD are fired.
That would happen, if URIBL_RHS_DOB and another rule of the LO meta
variant are hit.
> The only rule in the message that could trigger them are URIBL_DBL_SPAM
> and URIBL_RHS_DOB
DBL is not part of the meta, so I don't get this. Or did you actually
mean to communicate, these are the only URI DNSBL rules triggered? That
would be even more confusing -- a real Status header copied would have
helped...
The above rules are *verbatim*, copy and paste from your rc files, with
no human messing around, right?
In a related note, as per the M::SA::Conf docs for meta rules -- "The
value of a hit meta test is that of its arithmetic expression. The value
of a hit eval test is that returned by its method."
The latter means, this style of adding "rules" is not necessarily safe,
since these are eval tests. However, in this case, I believe they all
should be set to 1 in case of a match.
The former means, you could eliminate such issues due to inconsistencies
and code duplication, by using an additional meta level:
meta __VALUE FOO + BAR
meta ONE __VALUE == 1
meta TWO __VALUE == 2
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
