Hi!
I switched from 3.4.6 to 4.0.0-rc3 last week and since then I experience
unexpected/missing results from meta rules which definitely worked on 3.4.6.
I noticed it especially on one large meta rule which "summarizes" the
results using "+", "&&", "||" and ">". Since SA4 did not complain about any
meta rule at all I cutted the rule into peaces and found one specific part
which made the result of the whole rule "undefined" at any time while the
other parts had correct sums.
I was able to reduce this to a test ruleset which fails in the same way...
header __SA4T_NOMATCH Subject =~ /dsfasjdhfkjshfjsdklfhaskf/
meta __SA4TA1 (((! __SA4T_NOMATCH) || __SPOOFED_URL) && URIBL_SBL )
meta __SA4TA2 (__SA4TA1 * 3 ) + 1
IMO __SA4TA2 should always be 1 or more (4). But in this case if URIBL_SBL
is not hit it is undefined.
I also found that modifying __SA4TA1 to
meta __SA4TA1 (((! __SA4T_NOMATCH) || __SPOOFED_URL) && __UNDEF )
fails in the same way and __SA4TA2 is always undefined.
In case of URIBL_SBL I don't know why it gets undefined, since other RBLs
work in the same place (eg. URIBL_BLACK) as expected and the result is 1.
And another quite simple ruleset...
meta __SA4TA3_1 6
meta __SA4TA3_2 2
meta __SA4TA3 (__SA4TA3_1 > 2) && (__SA4TA3_2 > 1)
doesn't set __SA4TA3. This was working an SA3.4 as well.
Is this wanted behavior or a bug? Since UPGRADE does not contain any
information about basic changes for meta rules I assume it is a
bug/regression. But if this is wanted how should this be done on SA4?
All tests were done on RHEL8.6 by feeding a real EML file and network tests
active. So inherited "net" flags should not be an issue. But I also see no
reason why a meta rule that does not exclusively depend on "net" sub rules
should inherit this flag? Currently it is propagated if a single sub rule
has the flag. Not a big issue on my side since I do not plan to use SA
without net rules.
Greetings,
Wolfgang Breyha
--
Wolfgang Breyha <wbre...@gmx.net> | https://www.blafasel.at/
Vienna University Computer Center | Austria
