From: "John Wilcock" <j...@tradoc.fr>
The bug has definitely been fixed for SpamAssassin 3.3.2, and the bugzilla
states that the same is true for all 3.3.x.
RCVD_ILLEGAL_IP X-Spam-Relays-Untrusted =~ /
(?:by|ip)=(?=\d+\.\d+\.\d+\.\d+ )(?:(?:0|2(?:2[4-9]|[3-5]\d)|192\.0\.2|198\.51\.100|203\.0\.113)\.|(?:\d+\.){0,3}(?!(?:2(?:[0-4]\d|5[0-5])|[01]?\d\d?)\b))/
If your rule differs, then either you have an sa-update problem or the
rule hasn't been corrected for 3.3.1.
= =======
I have found 2 instances of the file 20_head_tests.cf on my server.
The first stays in /usr/share/spamassassin and contains the following
regexp:
/ (?:by|ip)=(?:[057]|22[4-9]|2[3-9]\d|[12]\d{3,}|[3-9]\d\d+)\.\d+\.\d+\.\d+
/
The second in /var/lib/spamassassin/3.003001/updates_spamassassin_org and
contains:
/
(?:by|ip)=(?=\d+\.\d+\.\d+\.\d+
)(?:(?:0|2(?:2[4-9]|[3-5]\d)|192\.0\.2|198\.51\.100|203\.0\.113)\.|(?:\d+\.){0,3}(?!(?:2(?:[0-4]\d|5[0-5])|[01]?\d\d?)\b))/
So, maybe SA uses the wrong files.
The other possibility stays with the spampd policy daemon. With a server
uptime of several months I cannot remember the last time I stopped and
restarted the daemon.
I will do that now and monitor closely.
Thank you for your answer.
Frédéric
