Disabling eval rules (was: Re: Testing Botnet)
On Sat, 2008-01-12 at 12:23 -0800, Robert - elists wrote:
Sounds like you've been hit by bug 5519 [1] before the upgrade in Oct.
Setting rules scores to 0 did *not* prevent these tests from being
evaluated for SA 3.2.x before 3.2.3.
Fixed since 3.2.3. Plugin eval rules with 0 scores are meant no not be
evaluated, and of course to not show up in the report.
Interesting, does this mean that we should be changing scores we care about
and want to see eval'd in the reports to .01 or something similar?
Any other implications in the bug and current or future fix methods?
AFAIK, nope. That should be all. However...
I noticed that even my SA 3.2.4 still evaluates my URICountry plugin
rules, which are set to a score of 0.0 [1]. Which actually should *not*
happen since 3.2.3.
Anyone got a guess why? Devs?
guenther
[1] originally set up for exactly this testing purpose, btw
--
char *t=[EMAIL PROTECTED];
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;il;i++){ i%8? c=1:
(c=*++x); c128 (s+=h); if (!(h=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Testing Botnet
On Sat, 2008-01-12 at 18:03 +, Arthur Dent wrote:
Hello All,
I'm afraid that I might have wasted your time - Hence the change to the thread
Subject.
I guess that what triggered my original question was the fact that I was
trying to check that everything was working following an OS upgrade. Looking
back through my spam corpus it seemed that I would get Botnet Serverwords in
the headers of probably about 2 out of three spam emails (it was however
scored at 0).
These stopped abruptly in October when I upgraded SA.
Sounds like you've been hit by bug 5519 [1] before the upgrade in Oct.
Setting rules scores to 0 did *not* prevent these tests from being
evaluated for SA 3.2.x before 3.2.3.
Fixed since 3.2.3. Plugin eval rules with 0 scores are meant no not be
evaluated, and of course to not show up in the report.
karsten
[1] Zeroing a score does not disable plugin eval rules
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5519
--
char *t=[EMAIL PROTECTED];
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;il;i++){ i%8? c=1:
(c=*++x); c128 (s+=h); if (!(h=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
RE: Testing Botnet
Sounds like you've been hit by bug 5519 [1] before the upgrade in Oct. Setting rules scores to 0 did *not* prevent these tests from being evaluated for SA 3.2.x before 3.2.3. Fixed since 3.2.3. Plugin eval rules with 0 scores are meant no not be evaluated, and of course to not show up in the report. karsten Karsten Interesting, does this mean that we should be changing scores we care about and want to see eval'd in the reports to .01 or something similar? Any other implications in the bug and current or future fix methods? - rh
