You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2011/09/17 14:37:48 UTC
[Bug 6660] New: __NSL_RCVD_FROM_41 should include test for (41. in
addition to [41.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
Bug #: 6660
Summary: __NSL_RCVD_FROM_41 should include test for (41. in
addition to [41.
Product: Spamassassin
Version: 3.3.1
Platform: PC
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P2
Component: spamassassin
AssignedTo: dev@spamassassin.apache.org
ReportedBy: mrl@psfc.mit.edu
Classification: Unclassified
__NSL_RCVD_FROM_41 only tests for Received lines that include [41., but should
also include (41, like the following:
Received: from unknown (41.81.214.89)
by p3plsmtpa01-10.prod.phx3.secureserver.net (72.167.82.90) with ESMTP; 17
Sep 2011 09:37:12 -0000
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6660] __NSL_RCVD_FROM_41 should include test for (41. in
addition to [41.
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
--- Comment #6 from Mark London <mr...@psfc.mit.edu> 2012-05-08 15:23:43 UTC ---
I decided to add my comments to Bug 6768 instead.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6660] __NSL_RCVD_FROM_41 should include test for (41. in
addition to [41.
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
Mark Martinec <Ma...@ijs.si> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|Undefined |3.4.0
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6660] __NSL_RCVD_FROM_41 should include test for (41. in
addition to [41.
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
John Hardin <jh...@impsec.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
CC| |jhardin@impsec.org
Resolution| |FIXED
--- Comment #1 from John Hardin <jh...@impsec.org> 2011-09-17 14:53:38 UTC ---
Committed revision 1171995
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6660] __NSL_RCVD_FROM_41 should include test for (41. in
addition to [41.
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
Mark London <mr...@psfc.mit.edu> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mrl@psfc.mit.edu
--- Comment #4 from Mark London <mr...@psfc.mit.edu> 2012-05-08 15:20:19 UTC ---
Spammers from the 41 ip range are constantly using authenticated squirrelmail
accounts (or at least inserting fake headers), so that the built-in Received
header test (ip=41) is not being triggered. I think that at least for the 41
domain, __NSL_RCVD_FROM_41 should be triggered, regardless of how it
originates.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6660] __NSL_RCVD_FROM_41 should include test for (41. in
addition to [41.
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
Mark London <mr...@psfc.mit.edu> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
--- Comment #5 from Mark London <mr...@psfc.mit.edu> 2012-05-08 15:22:31 UTC ---
I'm addressing my comments to Bug 6778 instead.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
Re: [SA-dev] [Bug 6660] __NSL_RCVD_FROM_41 should include test for
(41. in addition to [41.
Posted by Adam Katz <an...@khopis.com>.
> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
On 09/25/2011 10:43 AM, John Hardin wrote on bugzilla:
>> header __NSL_RCVD_FROM_41 X-Spam-Relays-External =~ / ip=41\./
>
> Hrm. I'm now wondering whether having __NSL_RCVD_FROM_41 as a subset of
> __RCVD_VIA_AFRINIC has any value...
On Sun, 25 Sep 2011, John Hardin amended privately:
> Actually, it's more a subset of __RCVD_VIA_AFRINIC_E since
> __RCVD_VIA_AFRINIC is anchored on the last external.
>
> Would you be willing to remove the "nopublish" from
> __RCVD_VIA_AFRINIC_E? That rule may be handy in metas.
I have only one issue with releasing the rest of the __RCVD_VIA_* rules,
which is a very stern reminder that using them is almost certainly a Bad
Idea, with its apparent merits tainted by the limitations of our ham
corpora.
I'll say that again: we do not have enough ham from Africa or Latin
America to understand how to properly use these rules.
If you block based (in part or wholly) on __RCVD_VIA_AFRINIC_E, you doom
South Africa to the same bucket as Nigeria. The 41/8 CIDR is restricted
to just Nigeria and surrounding areas, which (until they improve their
education and infrastructure) is pretty well correlated with advance-fee
fraudsters. AfriNIC's entire dedicated space is not a fair target.
Read these stats with a grain of salt:
http://ruleqa.spamassassin.org/?daterev=20110926&rule=%2FRCVD_VIA
SPAM% HAM% S/O RANK NAME
2.2063 0.0058 0.997 0.87 __RCVD_VIA_AFRINIC
2.3564 0.1116 0.955 0.75 __RCVD_VIA_AFRINIC_E
4.8714 0.7709 0.863 0.61 __RCVD_VIA_LACNIC
34.8814 3.0100 0.921 0.57 __RCVD_VIA_APNIC
35.6669 3.8372 0.903 0.56 __RCVD_VIA_APNIC_E
4.9684 1.7034 0.745 0.54 __RCVD_VIA_LACNIC_E
47.1530 14.6071 0.763 0.51 __RCVD_VIA_RIPE
0.0158 0.0010 0.943 0.50 __RCVD_VIA_NON_RIR_E
49.6605 21.5889 0.697 0.50 __RCVD_VIA_RIPE_E
0 0.0010 0.000 0.48 __RCVD_VIA_NON_RIR
10.6118 79.2411 0.118 0.41 __RCVD_VIA_ARIN_E
4.8754 73.0384 0.063 0.39 __RCVD_VIA_ARIN
0.0014 0.1577 0.009 0.32 __RCVD_VIA_IPV6
0.0072 1.8275 0.004 0.11 __RCVD_VIA_IPV6_E
[Bug 6660] __NSL_RCVD_FROM_41 should include test for (41. in
addition to [41.
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
--- Comment #3 from John Hardin <jh...@impsec.org> 2011-09-25 17:43:42 UTC ---
(In reply to comment #2)
> (In reply to comment #1)
> > Committed revision 1171995
> > -header __NSL_RCVD_FROM_41 Received =~ /\[41\./
> > +header __NSL_RCVD_FROM_41 Received =~ /[([]41\./
>
> You're better off with the built-in Received header parser:
>
> header __NSL_RCVD_FROM_41 X-Spam-Relays-External =~ / ip=41\./
Hrm. I'm now wondering whether having __NSL_RCVD_FROM_41 as a subset of
__RCVD_VIA_AFRINIC has any value...
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6660] __NSL_RCVD_FROM_41 should include test for (41. in
addition to [41.
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
Adam Katz <an...@khopis.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
CC| |antispam@khopis.com
Resolution|FIXED |
--- Comment #2 from Adam Katz <an...@khopis.com> 2011-09-21 17:41:41 UTC ---
(In reply to comment #1)
> Committed revision 1171995
> -header __NSL_RCVD_FROM_41 Received =~ /\[41\./
> +header __NSL_RCVD_FROM_41 Received =~ /[([]41\./
You're better off with the built-in Received header parser:
header __NSL_RCVD_FROM_41 X-Spam-Relays-External =~ / ip=41\./
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.