Well, I opened up bug 5618 suggesting the full spelling of the alternate
subject. I don't think it matters what the dev's do about the subject. The
target message has to hit __HAVE_BOUNCE_RELAYS and not hit MY_SERVERS_FOUND
and further hit one of the subject messages.
I did receive a true bounce with this oddball subject and the meta rule
didn't fire. That's about the best I can do for testing. So, unless UPS or a
cargo carrier's Delivery Status Notification also fires
__HAVE_BOUNCE_RELAYS, then there won't be any FP's.
Unfortunately, my perl isn't good enough to know what
hav_any_bounce_relays() really does<g>.
sub have_any_bounce_relays {
my ($self, $pms) = @_;
return (defined $pms->{conf}->{whitelist_bounce_relays} &&
(scalar values %{$pms->{conf}->{whitelist_bounce_relays}} != 0));
}
I imagine the dev's will test a few messages before releasing this to the
wild<g>.
Dan
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Monday, August 20, 2007 1:32 PM
To: users@spamassassin.apache.org
Subject: Re: Why'd VBounce not hit?
Kai Schaetzl writes:
> Dan Barker wrote on Mon, 20 Aug 2007 09:05:44 -0400:
>
> > a) Investigate the possibility of FP's due to this change. It
> > "looks" OK to me, but I don't have a large corpus of non-bounce
> > delivery status notifications against which to test (er, ah, I have
> > none<g>)
>
> As this rule *wants* to match non-malware bounces it would be hard to
> define an FP in this case. ;-) Actually, I think you could make it
> much more generic without creating FPs.
>
> /Delivery Status Notification/
> /Delivery Failure Notification/
>
> ->
>
> /Delivery.*Notification/
>
> should be ok to use. There is a slight chance it matches a "Delivery
> Notification" that comes from UPS or a cargo carrier, in case they
> send out something like this, but at least I haven't yet seen any.
actually, it's better to keep these Subject rules as *non*-generic as
possible -- as you note, "notifications" about "deliveries"
are not rare, and FPs are best avoided.
I'd even suggest:
/^Delivery Status Notification/
/^Delivery Failure Notification/
--j.
