Re: Rule to match X-Spam-Flag

2011-06-10 Thread Benny Pedersen
On Thu, 09 Jun 2011 22:38:25 -0400, Daryl C. W. O'Shea wrote: header CUSTOM_X_SPAM_FLAG X-Spam-Flag:raw =~ /\bYES\b/i nope, is headers case sensitive ? spamassassin have case like the above, but aol changed it all uppercase, and my rule works from spamassassin, but fails in amavis since

Re: Rule to match X-Spam-Flag

2011-06-10 Thread Alessandro Dentella
On Thu, Jun 09, 2011 at 10:38:25PM -0400, Daryl C. W. O'Shea wrote: On 09/06/2011 10:26 PM, Benny Pedersen wrote: On Fri, 10 Jun 2011 04:08:08 +0200, Benny Pedersen wrote: On Thu, 09 Jun 2011 22:00:09 -0400, Daryl C. W. O'Shea wrote: header CUSTOM_X_SPAM_FLAG ALL:raw =~ /\bX-Spam-Flag:

Re: Rule to match X-Spam-Flag

2011-06-10 Thread Mark Martinec
Benny, On Thu, 09 Jun 2011 22:38:25 -0400, Daryl C. W. O'Shea wrote: header CUSTOM_X_SPAM_FLAG X-Spam-Flag:raw =~ /\bYES\b/i Can't work, the M::S::PerMsgStatus::check_timed calls: $self-{msg}-delete_header('X-Spam-.*'); before invoking any checks. Moving that call further down makes it

FRT_SOMA: what does it mean?

2011-06-10 Thread Alessandro Dentella
Hi, I see some mail are hit by FRT_SOMA rule that I see is defined as: ##{ FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags^M body FRT_SOMA

Re: FRT_SOMA: what does it mean?

2011-06-10 Thread Daniel McDonald
On 6/10/11 8:53 AM, Alessandro Dentella san...@e-den.it wrote: Hi, I see some mail are hit by FRT_SOMA rule that I see is defined as: ##{ FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags^M body FRT_SOMA

Re: FRT_SOMA: what does it mean?

2011-06-10 Thread John Hardin
On Fri, 10 Jun 2011, Alessandro Dentella wrote: I see some mail are hit by FRT_SOMA rule that I see is defined as: ##{ FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags^M body FRT_SOMA /post

Sought rules

2011-06-10 Thread Jezz
Hi all, I recently upgraded SpamAssassin from 3.2.5 to 3.3.1, and I discovered that the JM_SOUGHT_FRAUD_x rules are now included within the official ruleset, within the 72_active.cf file. However, as far as I can tell, these rules seem to be different to the same-named rules that are within

Re: Sought rules

2011-06-10 Thread Karsten Bräckelmann
On Fri, 2011-06-10 at 18:07 +0200, Jezz wrote: I recently upgraded SpamAssassin from 3.2.5 to 3.3.1, and I discovered that the JM_SOUGHT_FRAUD_x rules are now included within the official ruleset, within the 72_active.cf file. However, as far as I can tell, these rules seem to be different

Re: Rule to match X-Spam-Flag

2011-06-10 Thread Benny Pedersen
On Fri, 10 Jun 2011 11:29:23 +0200, Alessandro Dentella wrote: thanks to all of you for the great support. super duper will test this in postfix, just a shame one need to turn postfix into a content filter just to make it work :(

Re: Sought rules

2011-06-10 Thread Warren Togami Jr.
On 6/10/2011 7:14 AM, Karsten Bräckelmann wrote: You are generally correct about the numerical (actually lexical) order, though it doesn't apply to the files you are talking about. The mentioned 72_active and 20_sought are in different sa-update channels. Now, the bad thing about this is that

BOTNET IPv6 patch

2011-06-10 Thread Matthew Newton
Hi, I've noticed for a while on my home mail server that BOTNET was scoring for every mail coming over IPv6. Having just use the excuse of World IPv6 day to enable it on the servers here, too, I needed to fix that or remove the test. I've therefore hacked together the following patch to

Re: Sought rules

2011-06-10 Thread Karsten Bräckelmann
On Fri, 2011-06-10 at 11:19 -1000, Warren Togami Jr. wrote: On 6/10/2011 7:14 AM, Karsten Bräckelmann wrote: Now, the bad thing about this is that updates_spamassassin_org.cf is lexically *after* sought_rules_yerp_org.cf in your rule update dir. Which means the more recent rules in the

Re: Sought rules

2011-06-10 Thread Michael Scheidell
On 6/10/11 5:49 PM, Karsten Bräckelmann wrote: While I do agree this is an issue -- at the very least, all third-party sought channel docs should include that note -- I do not agree that this is worrisome. The negative impact basically boils down to the channel does not work. so, the 'best

Re: BOTNET IPv6 patch

2011-06-10 Thread Jari Fredriksson
11.6.2011 0:41, Matthew Newton kirjoitti: I've therefore hacked together the following patch to Botnet.pm (0.8). It should fix the main issue that BOTNET does not do any lookups for IP addresses that look like IPv6 addresses. It Hi! I really need that, but the patch did not work, ot

Re: Sought rules

2011-06-10 Thread Karsten Bräckelmann
On Fri, 2011-06-10 at 19:32 -0400, Michael Scheidell wrote: On 6/10/11 5:49 PM, Karsten Bräckelmann wrote: While I do agree this is an issue -- at the very least, all third-party sought channel docs should include that note -- I do not agree that this is worrisome. The negative impact

Re: Sought rules

2011-06-10 Thread Warren Togami Jr.
On 6/10/2011 2:01 PM, Karsten Bräckelmann wrote: IFF you use the sought channel with SA 3.3.x, you will need the reorder hack to bend the alphabet. It is not entirely clear to me, what exactly are you supposed to rename for the reorder hack? You have to do it every time you sa-update?

Re: Sought rules

2011-06-10 Thread Lawrence @ Rogers
On 10/06/2011 10:24 PM, Warren Togami Jr. wrote: On 6/10/2011 2:01 PM, Karsten Bräckelmann wrote: IFF you use the sought channel with SA 3.3.x, you will need the reorder hack to bend the alphabet. It is not entirely clear to me, what exactly are you supposed to rename for the reorder hack?

Re: Sought rules

2011-06-10 Thread John Hardin
On Fri, 10 Jun 2011, Lawrence @ Rogers wrote: On 10/06/2011 10:24 PM, Warren Togami Jr. wrote: On 6/10/2011 2:01 PM, Karsten Bräckelmann wrote: IFF you use the sought channel with SA 3.3.x, you will need the reorder hack to bend the alphabet. It is not entirely clear to me, what

Re: Sought rules

2011-06-10 Thread Warren Togami Jr.
On 6/10/2011 3:34 PM, John Hardin wrote: On Fri, 10 Jun 2011, Lawrence @ Rogers wrote: On 10/06/2011 10:24 PM, Warren Togami Jr. wrote: On 6/10/2011 2:01 PM, Karsten Bräckelmann wrote: IFF you use the sought channel with SA 3.3.x, you will need the reorder hack to bend the alphabet. It is

Re: Sought rules

2011-06-10 Thread Karsten Bräckelmann
On Fri, 2011-06-10 at 14:54 -1000, Warren Togami Jr. wrote: On 6/10/2011 2:01 PM, Karsten Bräckelmann wrote: IFF you use the sought channel with SA 3.3.x, you will need the reorder hack to bend the alphabet. It is not entirely clear to me, what exactly are you supposed to rename for

Re: Sought rules

2011-06-10 Thread Karsten Bräckelmann
On Fri, 2011-06-10 at 22:40 -0230, Lawrence @ Rogers wrote: Would renaming 20_sought_fraud.cf to 99_sought_fraud.cf, putting 20_sought_fraud.cf (from the yelp.org channel) after 72_active.cf (the default and assumed older SA rules) solve this problem? No, because they are in sub-directories.